CVE-2023-4066 - Vulnerability Details

Vendors	Products
Redhat	Amq Broker Enterprise Linux Jboss A-mq Jboss Middleware Openshift Container Platform Rhosemc

Package	CPE	Advisory	Released Date
RHEL-8 based Middleware Containers
amq7/amq-broker-rhel8-operator:7.11.1-9	cpe:/a:redhat:rhosemc:1.0::el8	RHSA-2023:4720	2023-08-23T00:00:00Z
amq7/amq-broker-rhel8-operator-bundle:7.11.1-12	cpe:/a:redhat:rhosemc:1.0::el8	RHSA-2023:4720	2023-08-23T00:00:00Z

Link	Providers
https://access.redhat.com/errata/RHSA-2023:4720
https://access.redhat.com/security/cve/CVE-2023-4066
https://bugzilla.redhat.com/show_bug.cgi?id=2224677
https://nvd.nist.gov/vuln/detail/CVE-2023-4066
https://www.cve.org/CVERecord?id=CVE-2023-4066

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-4066", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2023-08-01T18:02:36.130Z", "datePublished": "2023-09-27T20:54:42.212Z", "dateUpdated": "2024-11-22T23:58:09.296Z"}, "containers": {"cna": {"title": "Operator: passwords defined in secrets shown in statefulset yaml", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker."}], "affected": [{"vendor": "Red Hat", "product": "RHEL-8 based Middleware Containers", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "amq7/amq-broker-rhel8-operator", "defaultStatus": "affected", "versions": [{"version": "7.11.1-9", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhosemc:1.0::el8"]}, {"vendor": "Red Hat", "product": "RHEL-8 based Middleware Containers", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "amq7/amq-broker-rhel8-operator-bundle", "defaultStatus": "affected", "versions": [{"version": "7.11.1-12", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhosemc:1.0::el8"]}, {"vendor": "Red Hat", "product": "Red Hat AMQ Broker 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "activemq-broker-operator", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:amq_broker:7"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2023:4720", "name": "RHSA-2023:4720", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2023-4066", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224677", "name": "RHBZ#2224677", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2023-08-23T00:00:00+00:00", "problemTypes": [{"descriptions": [{"cweId": "CWE-313", "description": "Cleartext Storage in a File or on Disk", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-313: Cleartext Storage in a File or on Disk", "timeline": [{"lang": "en", "time": "2023-07-21T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2023-08-23T00:00:00+00:00", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2024-11-22T23:58:09.296Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-09T14:33:59.030071Z", "id": "CVE-2023-4066", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-09T14:34:07.996Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:17:11.980Z"}, "title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/errata/RHSA-2023:4720", "name": "RHSA-2023:4720", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2023-4066", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224677", "name": "RHBZ#2224677", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-4066 (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

state : PUBLISHED (string)

assignerShortName : redhat (string)

dateReserved : 2023-08-01T18:02:36.130Z (string)

datePublished : 2023-09-27T20:54:42.212Z (string)

dateUpdated : 2024-11-22T23:58:09.296Z (string)

}

containers : { »

cna : { »

title : Operator: passwords defined in secrets shown in statefulset yaml (string)

metrics : [ »

0 : { »

other : { »

content : { »

value : Moderate (string)

namespace : https://access.redhat.com/security/updates/classification/ (string)

}

type : Red Hat severity rating (string)

}

1 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 5.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker. (string)

}

]

affected : [ »

0 : { »

vendor : Red Hat (string)

product : RHEL-8 based Middleware Containers (string)

collectionURL : https://catalog.redhat.com/software/containers/ (string)

packageName : amq7/amq-broker-rhel8-operator (string)

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 7.11.1-9 (string)

lessThan : * (string)

versionType : rpm (string)

status : unaffected (string)

}

]

cpes : [ »

0 : cpe:/a:redhat:rhosemc:1.0::el8 (string)

]

}

1 : { »

vendor : Red Hat (string)

product : RHEL-8 based Middleware Containers (string)

collectionURL : https://catalog.redhat.com/software/containers/ (string)

packageName : amq7/amq-broker-rhel8-operator-bundle (string)

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 7.11.1-12 (string)

lessThan : * (string)

versionType : rpm (string)

status : unaffected (string)

}

]

cpes : [ »

0 : cpe:/a:redhat:rhosemc:1.0::el8 (string)

]

}

2 : { »

vendor : Red Hat (string)

product : Red Hat AMQ Broker 7 (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

packageName : activemq-broker-operator (string)

defaultStatus : affected (string)

cpes : [ »

0 : cpe:/a:redhat:amq_broker:7 (string)

]

}

]

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2023:4720 (string)

name : RHSA-2023:4720 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

1 : { »

url : https://access.redhat.com/security/cve/CVE-2023-4066 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

]

}

2 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2224677 (string)

name : RHBZ#2224677 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

]

}

]

datePublic : 2023-08-23T00:00:00+00:00 (string)

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-313 (string)

description : Cleartext Storage in a File or on Disk (string)

lang : en (string)

type : CWE (string)

}

]

}

]

x_redhatCweChain : CWE-313: Cleartext Storage in a File or on Disk (string)

timeline : [ »

0 : { »

lang : en (string)

time : 2023-07-21T00:00:00+00:00 (string)

value : Reported to Red Hat. (string)

}

1 : { »

lang : en (string)

time : 2023-08-23T00:00:00+00:00 (string)

value : Made public. (string)

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2024-11-22T23:58:09.296Z (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-07-09T14:33:59.030071Z (string)

id : CVE-2023-4066 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-07-09T14:34:07.996Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T07:17:11.980Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2023:4720 (string)

name : RHSA-2023:4720 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

1 : { »

url : https://access.redhat.com/security/cve/CVE-2023-4066 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

2 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2224677 (string)

name : RHBZ#2224677 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/errata/RHSA-2023:4720", "name": "RHSA-2023:4720", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2023-4066", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224677", "name": "RHBZ#2224677", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:17:11.980Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-4066", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-09T14:33:59.030071Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-09T14:34:04.480Z"}}], "cna": {"title": "Operator: passwords defined in secrets shown in statefulset yaml", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:rhosemc:1.0::el8"], "vendor": "Red Hat", "product": "RHEL-8 based Middleware Containers", "versions": [{"status": "unaffected", "version": "7.11.1-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "amq7/amq-broker-rhel8-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhosemc:1.0::el8"], "vendor": "Red Hat", "product": "RHEL-8 based Middleware Containers", "versions": [{"status": "unaffected", "version": "7.11.1-12", "lessThan": "*", "versionType": "rpm"}], "packageName": "amq7/amq-broker-rhel8-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:amq_broker:7"], "vendor": "Red Hat", "product": "Red Hat AMQ Broker 7", "packageName": "activemq-broker-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2023-07-21T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2023-08-23T00:00:00+00:00", "value": "Made public."}], "datePublic": "2023-08-23T00:00:00+00:00", "references": [{"url": "https://access.redhat.com/errata/RHSA-2023:4720", "name": "RHSA-2023:4720", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2023-4066", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224677", "name": "RHBZ#2224677", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-313", "description": "Cleartext Storage in a File or on Disk"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2024-10-09T07:39:50.746Z"}, "x_redhatCweChain": "CWE-313: Cleartext Storage in a File or on Disk"}}, "cveMetadata": {"cveId": "CVE-2023-4066", "state": "PUBLISHED", "dateUpdated": "2024-10-09T07:39:50.746Z", "dateReserved": "2023-08-01T18:02:36.130Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2023-09-27T20:54:42.212Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2023:4720 (string)

name : RHSA-2023:4720 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

1 : { »

url : https://access.redhat.com/security/cve/CVE-2023-4066 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

2 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2224677 (string)

name : RHBZ#2224677 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T07:17:11.980Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-4066 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-07-09T14:33:59.030071Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-07-09T14:34:04.480Z (string)

}

]

cna : { »

title : Operator: passwords defined in secrets shown in statefulset yaml (string)

metrics : [ »

0 : { »

other : { »

type : Red Hat severity rating (string)

content : { »

value : Moderate (string)

namespace : https://access.redhat.com/security/updates/classification/ (string)

}

1 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.5 (number)

attackVector : LOCAL (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:/a:redhat:rhosemc:1.0::el8 (string)

]

vendor : Red Hat (string)

product : RHEL-8 based Middleware Containers (string)

versions : [ »

0 : { »

status : unaffected (string)

version : 7.11.1-9 (string)

lessThan : * (string)

versionType : rpm (string)

}

]

packageName : amq7/amq-broker-rhel8-operator (string)

collectionURL : https://catalog.redhat.com/software/containers/ (string)

defaultStatus : affected (string)

}

1 : { »

cpes : [ »

0 : cpe:/a:redhat:rhosemc:1.0::el8 (string)

]

vendor : Red Hat (string)

product : RHEL-8 based Middleware Containers (string)

versions : [ »

0 : { »

status : unaffected (string)

version : 7.11.1-12 (string)

lessThan : * (string)

versionType : rpm (string)

}

]

packageName : amq7/amq-broker-rhel8-operator-bundle (string)

collectionURL : https://catalog.redhat.com/software/containers/ (string)

defaultStatus : affected (string)

}

2 : { »

cpes : [ »

0 : cpe:/a:redhat:amq_broker:7 (string)

]

vendor : Red Hat (string)

product : Red Hat AMQ Broker 7 (string)

packageName : activemq-broker-operator (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

defaultStatus : affected (string)

}

]

timeline : [ »

0 : { »

lang : en (string)

time : 2023-07-21T00:00:00+00:00 (string)

value : Reported to Red Hat. (string)

}

1 : { »

lang : en (string)

time : 2023-08-23T00:00:00+00:00 (string)

value : Made public. (string)

}

]

datePublic : 2023-08-23T00:00:00+00:00 (string)

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2023:4720 (string)

name : RHSA-2023:4720 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

1 : { »

url : https://access.redhat.com/security/cve/CVE-2023-4066 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

]

}

2 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2224677 (string)

name : RHBZ#2224677 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-313 (string)

description : Cleartext Storage in a File or on Disk (string)

}

]

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2024-10-09T07:39:50.746Z (string)

}

x_redhatCweChain : CWE-313: Cleartext Storage in a File or on Disk (string)

}

cveMetadata : { »

cveId : CVE-2023-4066 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-09T07:39:50.746Z (string)

dateReserved : 2023-08-01T18:02:36.130Z (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

datePublished : 2023-09-27T20:54:42.212Z (string)

assignerShortName : redhat (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:*", "matchCriteriaId": "A58966CB-36AF-4E64-AB39-BE3A0753E155", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:*", "matchCriteriaId": "1F4A0F87-524E-4935-9B07-93793D8143FD", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*", "matchCriteriaId": "EA983F8C-3A06-450A-AEFF-9429DE9A3454", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*", "matchCriteriaId": "40449571-22F8-44FA-B57B-B43F71AB25E2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en AMQ Broker de Red Hat, que almacena ciertas contrase\u00f1as en un m\u00f3dulo secreto de propiedades de seguridad definido en ActivemqArtemisSecurity CR; sin embargo, se muestran en texto plano en el yaml de detalles de StatefulSet de AMQ Broker."}], "id": "CVE-2023-4066", "lastModified": "2024-11-21T08:34:20.057", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-27T21:15:10.550", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2023:4720"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2023-4066"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224677"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2023:4720"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2023-4066"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224677"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-313"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-312"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:* (string)

matchCriteriaId : A58966CB-36AF-4E64-AB39-BE3A0753E155 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:* (string)

matchCriteriaId : 1F4A0F87-524E-4935-9B07-93793D8143FD (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:* (string)

matchCriteriaId : EA983F8C-3A06-450A-AEFF-9429DE9A3454 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* (string)

matchCriteriaId : 40449571-22F8-44FA-B57B-B43F71AB25E2 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* (string)

matchCriteriaId : F4CFF558-3C47-480D-A2F0-BABF26042943 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker. (string)

}

1 : { »

lang : es (string)

value : Se encontró una falla en AMQ Broker de Red Hat, que almacena ciertas contraseñas en un módulo secreto de propiedades de seguridad definido en ActivemqArtemisSecurity CR; sin embargo, se muestran en texto plano en el yaml de detalles de StatefulSet de AMQ Broker. (string)

}

]

id : CVE-2023-4066 (string)

lastModified : 2024-11-21T08:34:20.057 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 5.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 3.6 (number)

source : secalert@redhat.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 5.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-09-27T21:15:10.550 (string)

references : [ »

0 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://access.redhat.com/errata/RHSA-2023:4720 (string)

}

1 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://access.redhat.com/security/cve/CVE-2023-4066 (string)

}

2 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=2224677 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://access.redhat.com/errata/RHSA-2023:4720 (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://access.redhat.com/security/cve/CVE-2023-4066 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=2224677 (string)

}

]

sourceIdentifier : secalert@redhat.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-313 (string)

}

]

source : secalert@redhat.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-312 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2023:4720", "cpe": "cpe:/a:redhat:rhosemc:1.0::el8", "package": "amq7/amq-broker-rhel8-operator:7.11.1-9", "product_name": "RHEL-8 based Middleware Containers", "release_date": "2023-08-23T00:00:00Z"}, {"advisory": "RHSA-2023:4720", "cpe": "cpe:/a:redhat:rhosemc:1.0::el8", "package": "amq7/amq-broker-rhel8-operator-bundle:7.11.1-12", "product_name": "RHEL-8 based Middleware Containers", "release_date": "2023-08-23T00:00:00Z"}], "bugzilla": {"description": "Operator: Passwords defined in secrets shown in StatefulSet yaml", "id": "2224677", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224677"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-313", "details": ["A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.", "A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker."], "name": "CVE-2023-4066", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Affected", "package_name": "activemq-broker-operator", "product_name": "Red Hat AMQ Broker 7"}], "public_date": "2023-08-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-4066\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-4066"], "threat_severity": "Moderate"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2023:4720 (string)

cpe : cpe:/a:redhat:rhosemc:1.0::el8 (string)

package : amq7/amq-broker-rhel8-operator:7.11.1-9 (string)

product_name : RHEL-8 based Middleware Containers (string)

release_date : 2023-08-23T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2023:4720 (string)

cpe : cpe:/a:redhat:rhosemc:1.0::el8 (string)

package : amq7/amq-broker-rhel8-operator-bundle:7.11.1-12 (string)

product_name : RHEL-8 based Middleware Containers (string)

release_date : 2023-08-23T00:00:00Z (string)

}

]

bugzilla : { »

description : Operator: Passwords defined in secrets shown in StatefulSet yaml (string)

id : 2224677 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2224677 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 5.5 (string)

cvss3_scoring_vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

status : verified (string)

}

cwe : CWE-313 (string)

details : [ »

0 : A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker. (string)

1 : A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker. (string)

]

name : CVE-2023-4066 (string)

package_state : [ »

0 : { »

cpe : cpe:/a:redhat:amq_broker:7 (string)

fix_state : Affected (string)

package_name : activemq-broker-operator (string)

product_name : Red Hat AMQ Broker 7 (string)

}

]

public_date : 2023-08-23T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2023-4066 https://nvd.nist.gov/vuln/detail/CVE-2023-4066 (string)

]

threat_severity : Moderate (string)

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object