CVE-2023-0813 — Network-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to…

Description (CNA)

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	unaffected 3badecfc675f63d7f497c4d86c296a0b9ac267e7 before *
Red Hat / NETWORK-OBSERVABILITY-1.1.0-RHEL-8	unaffected v1.1.0-10 before *

CWE

CWE-285

References

https://access.redhat.com/errata/RHSA-2023:0786
https://access.redhat.com/security/cve/CVE-2023-0813
https://bugzilla.redhat.com/show_bug.cgi?id=2169468

ADP enrichment

CVE

No English description supplied.

https://access.redhat.com/errata/RHSA-2023:0786
https://access.redhat.com/security/cve/CVE-2023-0813
https://bugzilla.redhat.com/show_bug.cgi?id=2169468

CISA-ADP

No English description supplied.

No references supplied.