CVE-2023-4456

Summary

CVE-2023-4456 is a newly discovered vulnerability affecting the openshift-logging LokiStack. The issue lies in the caching mechanism where the key used is only the token, which is overly permissive. Consequently, a user with a token valid for one specific action can perform other actions, as long as the authorization for the initial action remains cached. This vulnerability poses a significant risk to security, as it allows unintended access and escalation of privileges. It is recommended that users update their LokiStack installation to mitigate this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.