CVE-2023-0923

moderate-risk

Published 2023-09-15

A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.

Do I need to act?

0.14% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

ADJACENT_NETWORK / LOW complexity

Affected Products (1)

Openshift Data Science

Affected Vendors

Redhat

References (6)

Vendor Advisory https://access.redhat.com/errata/RHSA-2023:0977

Vendor Advisory https://access.redhat.com/security/cve/CVE-2023-0923

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2171870

Vendor Advisory https://access.redhat.com/errata/RHSA-2023:0977

Vendor Advisory https://access.redhat.com/security/cve/CVE-2023-0923

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2171870

/ 100

moderate-risk

Severity 27/34 · High

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal