CVE-2023-3361
S3 credentials included when exporting elyra notebook
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output instead of an ID for a Kubernetes secret.
Se encontró una falla en Red Hat OpenShift Data Science. Al exportar un pipeline desde Elyra notebook pipeline editor como Python DSL o YAML, lee las credenciales de S3 del clúster (servidor de pipeline ds) y las guarda en texto plano en la salida generada en lugar de un ID para un secreto de Kubernetes.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-06-22 CVE Reserved
- 2023-10-04 CVE Published
- 2024-08-02 CVE Updated
- 2024-09-03 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-319: Cleartext Transmission of Sensitive Information
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2023-3361 | Third Party Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2216588 | Issue Tracking | |
| https://github.com/opendatahub-io/odh-dashboard/issues/1415 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Opendatahub Search vendor "Opendatahub" | Open Data Hub Dashboard Search vendor "Opendatahub" for product "Open Data Hub Dashboard" | < 1.28.1 Search vendor "Opendatahub" for product "Open Data Hub Dashboard" and version " < 1.28.1" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Openshift Data Science Search vendor "Redhat" for product "Openshift Data Science" | - | - |
Affected
| ||||||