PT-2021-20870 · Unknown · Noobaa-Operator

Hardik Vyas · Published 2021-05-13 · Updated 2022-10-27 · CVE-2021-3528

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: noobaa-operator versions prior to 5.7.0

Description: A flaw was found in noobaa-operator where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker with access to the log files could use this AuthToken to gain additional access into noobaa deployment and can read/modify system configuration.

Recommendations: For versions prior to 5.7.0, update to version 5.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to log files to minimize the risk of exploitation.

Fix

Insertion into Log File

Insufficiently Protected Credentials

Weakness Enumeration

CWE-532

CWE-522

Related Identifiers

CVE-2021-3528

Affected Products

Noobaa-Operator

References · 4

• https://bugzilla.redhat.com/show_bug.cgi?id=1955601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3528 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3528 · Vendor Advisory
• https://t.me/cvenotify/14394 · Telegram Post