« Back to list

CVE-2023-5056

Status: ModifiedMedium (4.1)—

A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Redhat — Service Interconnect

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2023-5056",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.1,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.4.3-5",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-config-sync-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.4.3-5",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-flow-collector-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.4.3-6",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-operator-bundle",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.4.3-3",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-router-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.4.3-4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-service-controller-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.4.3-6",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-site-controller-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2023-12-18T14:15:10.133",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2023:6219",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2023-5056",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2239517",
      "tags": [
        "Issue Tracking"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2023:6219",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2023-5056",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2239517",
      "tags": [
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en el operador Skupper, que puede permitir que una determinada configuración cree una cuenta de servicio que permitiría a un atacante autenticado en el clúster adyacente ver las implementaciones en todos los espacios de nombres del clúster. Este problema permite la visualización no autorizada de información fuera del ámbito del usuario."
    }
  ],
  "lastModified": "2026-06-17T06:47:27.190",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:service_interconnect:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12B0CF2B-D1E1-4E20-846E-6F0D873499A9"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}