Description
A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat RHOL-5.5-RHEL-8
Default version status: affected
v0.1.0-327 to < *unaffected
Red Hat RHOL-5.6-RHEL-8
Default version status: affected
v0.1.0-326 to < *unaffected
Red Hat RHOL-5.7-RHEL-8
Default version status: affected
v0.1.0-325 to < *unaffected