Vulnerability · Published Sep 26, 2023 · Assigned by redhat
CVE-2023-4065Operator: plaintext password in operator log
Medium 5.5
In plain English
A medium-severity security flaw in Red Hat AMQ Broker 7 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 84.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. This flaw allows an authenticated local attacker to access information outside of their permissions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | RHEL-8 based Middleware Containers | see references |
| Red Hat | RHEL-8 based Middleware Containers | see references |
| Red Hat | Red Hat AMQ Broker 7 | see references |
Weakness: CWE-117 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- RHSA-2023:4720 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-4065 vdb-entry, x_refsource_REDHAT
- RHBZ#2224630 issue-tracking, x_refsource_REDHAT