CVE-2023-5056

MEDIUM

Red Hat Service Interconnect - Authenticated Information Disclosure via Skupper Operator

Title source: llm

Description

A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview.

References (3)

Core 3

Core References

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2023:6219

Vendor Advisory vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2023-5056

Issue Tracking issue-tracking x_refsource_redhat

https://bugzilla.redhat.com/show_bug.cgi?id=2239517

Scores

CVSS v3 6.8

EPSS 0.0005

EPSS Percentile 15.5%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Details

CWE

CWE-862

Status published

Products (1)

redhat/service_interconnect 1.0

Published Dec 18, 2023

Tracked Since Feb 18, 2026