CVE-2023-4456
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A flaw was found in openshift-logging LokiStack where the key used for caching is too broad, relying solely on the token. This allows a user with a valid token for one action to execute other actions as long as the authorization for the original action is still cached.
Risk Assessment
This vulnerability may lead to unauthorized access to system functions by users with valid tokens, increasing the risk of security breaches.
Recommendation
It is recommended to implement a more granular caching key to restrict access to actions only to those authorized by the appropriate permissions.
Original NVD description (English source)
A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.