Skip to content
Fencer Vulns
medium 5.7

CVE-2023-4456 json

Openshift-logging: lokistack authorisation is cached too broadly

published 2023-08-21 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-54312

cvss
5.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.

Patch / fix

  • Red Hat RHOL-5.5-RHEL-8 v0.1.0-327
  • Red Hat RHOL-5.6-RHEL-8 v0.1.0-326
  • Red Hat RHOL-5.7-RHEL-8 v0.1.0-325

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-4456 updated cvss 5.7

openshift-logging: LokiStack authorisation is cached too broadly

  • Red Hat RHOL 5.5 for RHEL 8 openshift-logging/lokistack-gateway-rhel8 v0.1.0-327
    fixed: vendor fix RHSA-2023:5096
  • Red Hat RHOL 5.6 for RHEL 8 openshift-logging/lokistack-gateway-rhel8 v0.1.0-326
    fixed: vendor fix RHSA-2023:5095
  • Red Hat RHOL 5.7 for RHEL 8 openshift-logging/lokistack-gateway-rhel8 v0.1.0-325
    fixed: vendor fix RHSA-2023:4933
  • Red Hat RHOL 5.5 for RHEL 8 openshift-logging/kibana6-rhel8 v6.8.1-391, openshift-logging/vector-rhel8 v0.21.0-110, openshift-logging/fluentd-rhel8 v1.14.6-184, openshift-logging/eventrouter-rhel8 v0.4.0-169, openshift-logging/logging-loki-rhel8 v2.6.1-44, openshift-logging/loki-rhel8-operator v5.5.16-6, +11 more Red Hat RHOL 5.6 for RHEL 8 openshift-logging/kibana6-rhel8 v6.8.1-390, openshift-logging/vector-rhel8 v0.21.0-109, openshift-logging/fluentd-rhel8 v1.14.6-185, openshift-logging/eventrouter-rhel8 v0.4.0-168, openshift-logging/logging-loki-rhel8 v2.8.3-12, openshift-logging/loki-rhel8-operator v5.6.11-6, +11 more Red Hat RHOL 5.7 for RHEL 8 openshift-logging/vector-rhel8 v0.28.1-14, openshift-logging/kibana6-rhel8 v6.8.1-389, openshift-logging/fluentd-rhel8 v1.14.6-181, openshift-logging/eventrouter-rhel8 v0.4.0-167, openshift-logging/logging-loki-rhel8 v2.8.3-11, openshift-logging/loki-rhel8-operator v5.7.6-5, +11 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

  • Red Hat RHOL-5.5-RHEL-8
  • Red Hat RHOL-5.6-RHEL-8
  • Red Hat RHOL-5.7-RHEL-8

Classification

Weakness
  • CWE-1220 Insufficient Granularity of Access Control

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.