PT-2023-2053 · Rhods · Rhods

Michael Kaplan · Published 2023-02-28 · Updated 2024-05-03 · CVE-2023-0923

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RHODS (affected versions not specified)

Description A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues. The vulnerability is related to insufficient authorization procedures, allowing a remote attacker to send arbitrary API requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2023-01773

CVE-2023-0923

Affected Products

Rhods

References · 12

• https://access.redhat.com/security/cve/CVE-2023-0923 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0923 · Security Note
• https://access.redhat.com/errata/RHSA-2023:0977 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01773 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2171870 · Vendor Advisory
• https://t.me/cibsecurity/70613 · Telegram Post
• https://t.me/cvenotify/79055 · Telegram Post
• https://twitter.com/DMFezzaReedCISA/status/1704364009430913031 · Twitter Post
• https://access.redhat.com/security/cve/cve-2023-0923 · Note
• https://twitter.com/cracbot/status/1702925350249054316 · Twitter Post
• https://t.me/cvenotify/58230 · Telegram Post