Skupper Operator Auth Bypass Allows Cross-Cluster Deployment Visibility
CVE-2023-5056 Published on December 18, 2023

Skupper-operator: privelege escalation via config map
A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview.

Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public. 44 days later.

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2023-5056 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2023-5056

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-5056 are published in Red Hat Service Interconnect:

Red Hat Service Interconnect
 

Affected Versions

Red Hat Service Interconnect 1 for RHEL 9: Red Hat Service Interconnect 1 for RHEL 9: Red Hat Service Interconnect 1 for RHEL 9: Red Hat Service Interconnect 1 for RHEL 9: Red Hat Service Interconnect 1 for RHEL 9: Red Hat Service Interconnect 1 for RHEL 9:

Exploit Probability

EPSS
0.05%
Percentile
16.64%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.