PT-2023-2053 · Rhods · Rhods

Michael Kaplan · Publicado 2023-02-28 · Atualizado 2024-05-03 · CVE-2023-0923

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RHODS (affected versions not specified)

Description A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues. The vulnerability is related to insufficient authorization procedures, allowing a remote attacker to send arbitrary API requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

BDU:2023-01773

CVE-2023-0923

Produtos afetados

Rhods

Referências · 12

• https://access.redhat.com/security/cve/CVE-2023-0923 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-0923 · Aviso do Fabricante
• https://t.me/cibsecurity/70613 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0923 · Nota de Segurança
• https://t.me/cvenotify/79055 · Publicação no Telegram
• https://access.redhat.com/errata/RHSA-2023:0977 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-01773 · Nota de Segurança
• https://twitter.com/DMFezzaReedCISA/status/1704364009430913031 · Publicação no Twitter
• https://bugzilla.redhat.com/show_bug.cgi?id=2171870 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2023-0923 · Nota
• https://twitter.com/cracbot/status/1702925350249054316 · Publicação no Twitter
• https://t.me/cvenotify/58230 · Publicação no Telegram