Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-0813

Network-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforced

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

github.com/netobserv/network-observability-console-plugin

  • 3badecfc675f63d7f497c4d86c296a0b9ac267e7 to < *unaffected

Red Hat NETWORK-OBSERVABILITY-1.1.0-RHEL-8

Default version status: affected

  • v1.1.0-10 to < *unaffected

References