First published: Fri Jul 26 2024(Updated: )
Several endpoints use the authHandler() and authHandlerWithUser() middleware functions. When the authentication provider is set to the default ("openShiftAuth"), no verification of authentication is actually performed by these functions, leaving the authentication/authorization checks to be performed by the targeted service. The following endpoints are using the aforementioned middleware functions without checking if the user provided valid credentials lead to various degrees of data exposure: /api/console/monitoring-dashboard-config /api/console/knative-event-sources /api/console/knative-channels /api/check-updates /api/console/version /api/copy-login-commands /api/gitops /api/plugins/ /api/metrics /api/metrics/usage
Affected Software | Affected Version | How to fix |
---|
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.