Critical severity · published Sep 15, 2023
CVE-2023-0923
Odh-notebook-controller-container: missing authorization allows for file contents disclosure
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
RHODS-1.22-RHEL-8 · Red Hat
All versions, or not specified · source: vendor
OD
Openshift Data Science · Redhat
1.22 before 1.22.1-3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0923
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0923
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:0977
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-0923
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2171870