Vulnerability · Published Sep 15, 2023 · Assigned by redhat
CVE-2023-0923Odh-notebook-controller-container: missing authorization allows for file contents disclosure
High 8.8
In plain English
A high-severity missing authorization in RHODS-1.22-RHEL-8 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.9%top 39.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | RHODS-1.22-RHEL-8 | see references |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- RHSA-2023:0977 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-0923 vdb-entry, x_refsource_REDHAT
- RHBZ#2171870 issue-tracking, x_refsource_REDHAT