Critical severity · published Sep 15, 2023
CVE-2023-0923
A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OD
Openshift Data Science · Redhat
1.22 before 1.22.1-3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0923
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0923
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:0977
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-0923
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2171870
More from Openshift Data Science
8.8
CVE-2024-7557
A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace
7.5
CVE-2023-3361
A flaw was found in Red Hat OpenShift Data Science