« Volver al listado

CVE-2023-5056

Estado: ModificadaMedia (4.1)—

A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Redhat — Service Interconnect

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-5056",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.1,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.4.3-5",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-config-sync-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.4.3-5",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-flow-collector-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.4.3-6",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-operator-bundle",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.4.3-3",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-router-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.4.3-4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-service-controller-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.4.3-6",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-site-controller-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2023-12-18T14:15:10.133",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2023:6219",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2023-5056",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2239517",
      "tags": [
        "Issue Tracking"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2023:6219",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2023-5056",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2239517",
      "tags": [
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en el operador Skupper, que puede permitir que una determinada configuración cree una cuenta de servicio que permitiría a un atacante autenticado en el clúster adyacente ver las implementaciones en todos los espacios de nombres del clúster. Este problema permite la visualización no autorizada de información fuera del ámbito del usuario."
    }
  ],
  "lastModified": "2026-06-17T06:47:27.190",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:service_interconnect:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12B0CF2B-D1E1-4E20-846E-6F0D873499A9"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}