REDHAT-BUG-2300037
First published: Fri Jul 26 2024(Updated: )
Several endpoints use the authHandler() and authHandlerWithUser() middleware functions. When the authentication provider is set to the default ("openShiftAuth"), no verification of authentication is actually performed by these functions, leaving the authentication/authorization checks to be performed by the targeted service. The following endpoints are using the aforementioned middleware functions without checking if the user provided valid credentials lead to various degrees of data exposure: /api/console/monitoring-dashboard-config /api/console/knative-event-sources /api/console/knative-channels /api/check-updates /api/console/version /api/copy-login-commands /api/gitops /api/plugins/ /api/metrics /api/metrics/usage
| Affected Software | Affected Version | How to fix |
|---|
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-7128
- agent/severity
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/description
- agent/event
- agent/tags
- agent/first-publish-date
- agent/type