Vulnerability-Lookup

CVE-2023-30841 (GCVE-0-2023-30841)

Vulnerability from cvelistv5 – Published: 2023-04-26 18:24 – Updated: 2025-01-30 21:30

Title

Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps

Summary

Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.

Severity

6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-30 21:30 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8020 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/metal3-io/baremetal-operator/s…	x_refsource_CONFIRM
https://github.com/metal3-io/baremetal-operator/p…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
metal3-io	baremetal-operator	Affected: < 0.3.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:37:15.430Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m"
          },
          {
            "name": "https://github.com/metal3-io/baremetal-operator/pull/1241",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/metal3-io/baremetal-operator/pull/1241"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-30841",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-30T21:30:47.489825Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-30T21:30:50.655Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "baremetal-operator",
          "vendor": "metal3-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster\u0027s Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-26T18:24:04.479Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m"
        },
        {
          "name": "https://github.com/metal3-io/baremetal-operator/pull/1241",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/metal3-io/baremetal-operator/pull/1241"
        }
      ],
      "source": {
        "advisory": "GHSA-9wh7-397j-722m",
        "discovery": "UNKNOWN"
      },
      "title": "Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-30841",
    "datePublished": "2023-04-26T18:24:04.479Z",
    "dateReserved": "2023-04-18T16:13:15.880Z",
    "dateUpdated": "2025-01-30T21:30:50.655Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-30841",
      "date": "2026-10-30",
      "epss": "0.00191",
      "percentile": "0.0883"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:linuxfoundation:baremetal_operator:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "AA9EF57A-FEA8-4F8F-8E1D-9F28B2DBC19F",
                  "versionEndExcluding": "0.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster\u0027s Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241."
        }
      ],
      "id": "CVE-2023-30841",
      "lastModified": "2024-11-21T08:00:57.157",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 6.0,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 1.5,
            "impactScore": 4.0,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2023-04-26T19:15:09.140",
      "references": [
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Exploit",
            "Issue Tracking",
            "Patch"
          ],
          "url": "https://github.com/metal3-io/baremetal-operator/pull/1241"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Exploit",
            "Issue Tracking",
            "Patch"
          ],
          "url": "https://github.com/metal3-io/baremetal-operator/pull/1241"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-200"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-319"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "baremetal-operator",
                "vendor": "metal3-io",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.3.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:linuxfoundation:baremetal_operator:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AA9EF57A-FEA8-4F8F-8E1D-9F28B2DBC19F",
                    "versionEndExcluding": "0.3.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster\u0027s Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241."
          }
        ],
        "id": "CVE-2023-30841",
        "lastModified": "2026-06-17T05:55:45.040",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 6.0,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.5,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-30841",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-30T21:30:47.489825Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-04-26T19:15:09.140",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Issue Tracking",
              "Patch"
            ],
            "url": "https://github.com/metal3-io/baremetal-operator/pull/1241"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Issue Tracking",
              "Patch"
            ],
            "url": "https://github.com/metal3-io/baremetal-operator/pull/1241"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-200"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-319"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-22T19:46:08+00:00",
      "cve": "CVE-2023-30841",
      "id": "CVE-2023-30841",
      "initial_release_date": "2023-04-27T00:00:00+00:00",
      "product_status:fixed": "10",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "616",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "baremetal-operator: plain-text username and hashed password readable by anyone having a cluster-wide read-access",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-30841.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T14:37:15.430Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m",
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m"
              },
              {
                "name": "https://github.com/metal3-io/baremetal-operator/pull/1241",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/metal3-io/baremetal-operator/pull/1241"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-30841",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-01-30T21:30:47.489825Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-01-30T21:29:49.216Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "baremetal-operator",
              "vendor": "metal3-io",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.3.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster\u0027s Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 6,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-200",
                  "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-04-26T18:24:04.479Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m"
            },
            {
              "name": "https://github.com/metal3-io/baremetal-operator/pull/1241",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/metal3-io/baremetal-operator/pull/1241"
            }
          ],
          "source": {
            "advisory": "GHSA-9wh7-397j-722m",
            "discovery": "UNKNOWN"
          },
          "title": "Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2023-30841",
        "datePublished": "2023-04-26T18:24:04.479Z",
        "dateReserved": "2023-04-18T16:13:15.880Z",
        "dateUpdated": "2025-01-30T21:30:50.655Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2023-30841

Vulnerability from fkie_nvd - Published: 2023-04-26 19:15 - Updated: 2026-06-17 05:55

Severity

6.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/metal3-io/baremetal-operator/pull/1241	Exploit, Issue Tracking, Patch
security-advisories@github.com	https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/metal3-io/baremetal-operator/pull/1241	Exploit, Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m	Vendor Advisory

Impacted products

	Vendor	Product	Version
	linuxfoundation	baremetal_operator	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "baremetal-operator",
          "vendor": "metal3-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.3.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxfoundation:baremetal_operator:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA9EF57A-FEA8-4F8F-8E1D-9F28B2DBC19F",
              "versionEndExcluding": "0.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster\u0027s Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241."
    }
  ],
  "id": "CVE-2023-30841",
  "lastModified": "2026-06-17T05:55:45.040",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-30841",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-01-30T21:30:47.489825Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-04-26T19:15:09.140",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/metal3-io/baremetal-operator/pull/1241"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/metal3-io/baremetal-operator/pull/1241"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-319"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-9WH7-397J-722M

Vulnerability from github – Published: 2023-04-26 19:46 – Updated: 2023-04-26 19:46

Summary

Ironic and ironic-inspector may expose as ConfigMaps

Details

Impact

Ironic and ironic-inspector deployed within Baremetal Operator using the included deploy.sh store their .htpasswd files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage.

Patches

This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards.

Workarounds

User may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241

Severity

6.0 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/metal3-io/baremetal-operator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-30841"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-319"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-26T19:46:00Z",
    "nvd_published_at": "2023-04-26T19:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nIronic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster\u0027s Etcd storage.\n\n### Patches\nThis issue is patched in [baremetal-operator PR#1241](https://github.com/metal3-io/baremetal-operator/pull/1241), and is included in BMO release 0.3.0 onwards.\n\n### Workarounds\nUser may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in [baremetal-operator PR#1241](https://github.com/metal3-io/baremetal-operator/pull/1241)\n",
  "id": "GHSA-9wh7-397j-722m",
  "modified": "2023-04-26T19:46:00Z",
  "published": "2023-04-26T19:46:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30841"
    },
    {
      "type": "WEB",
      "url": "https://github.com/metal3-io/baremetal-operator/pull/1241"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/metal3-io/baremetal-operator"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Ironic and ironic-inspector may expose as ConfigMaps"
}

GSD-2023-30841

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-30841

Aliases

CVE-2023-30841

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-30841",
    "id": "GSD-2023-30841"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-30841"
      ],
      "details": "Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster\u0027s Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.",
      "id": "GSD-2023-30841",
      "modified": "2023-12-13T01:20:52.067652Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-30841",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "baremetal-operator",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 0.3.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "metal3-io"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster\u0027s Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-200",
                "lang": "eng",
                "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m",
            "refsource": "MISC",
            "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m"
          },
          {
            "name": "https://github.com/metal3-io/baremetal-operator/pull/1241",
            "refsource": "MISC",
            "url": "https://github.com/metal3-io/baremetal-operator/pull/1241"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-9wh7-397j-722m",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c0.3.0",
          "affected_versions": "All versions before 0.3.0",
          "cwe_ids": [
            "CWE-1035",
            "CWE-200",
            "CWE-937"
          ],
          "date": "2023-04-26",
          "description": "Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster\u0027s Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.",
          "fixed_versions": [
            "0.3.0"
          ],
          "identifier": "CVE-2023-30841",
          "identifiers": [
            "GHSA-9wh7-397j-722m",
            "CVE-2023-30841"
          ],
          "not_impacted": "All versions starting from 0.3.0",
          "package_slug": "go/github.com/metal3-io/baremetal-operator",
          "pubdate": "2023-04-26",
          "solution": "Upgrade to version 0.3.0 or above.",
          "title": "Exposure of Sensitive Information to an Unauthorized Actor",
          "urls": [
            "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m",
            "https://github.com/metal3-io/baremetal-operator/pull/1241",
            "https://nvd.nist.gov/vuln/detail/CVE-2023-30841",
            "https://github.com/advisories/GHSA-9wh7-397j-722m"
          ],
          "uuid": "b1272366-8ab9-4161-9529-ea700ab1dd25"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:linuxfoundation:baremetal_operator:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.3.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2023-30841"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster\u0027s Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-319"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/metal3-io/baremetal-operator/pull/1241",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Issue Tracking",
                "Patch"
              ],
              "url": "https://github.com/metal3-io/baremetal-operator/pull/1241"
            },
            {
              "name": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-05-09T15:20Z",
      "publishedDate": "2023-04-26T19:15Z"
    }
  }
}

RHSA-2023:1326

Vulnerability from csaf_redhat - Published: 2023-05-17 22:30 - Updated: 2026-10-30 07:24

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.13.0 security update

Severity

Important

Scope

24 vulnerabilities in this advisory, including CVE-2023-30841.

CVE-2023-30841

A flaw was found in the baremetal-operator, where the ironic and ironic-inspector deployed within the baremetal operator using the included deploy.sh store `.htpasswd` files as ConfigMaps instead of Secrets. This issue causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster or access to the management cluster's etcd storage.

6.0 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Fixed: 4 products Known not affected: 602 products

https://access.redhat.com/errata/RHSA-2023:1326

Open the full advisory

RHSA-2023:6143

Vulnerability from csaf_redhat - Published: 2023-10-26 16:29 - Updated: 2026-10-30 07:40

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.14.0 CNF vRAN extras security update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2023-30841.

CVE-2023-30841

6.0 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Fixed: 1 product Known not affected: 7 products

https://access.redhat.com/errata/RHSA-2023:6143

Open the full advisory

RHSA-2023_1326

Vulnerability from csaf_redhat - Published: 2023-05-17 22:30 - Updated: 2024-12-17 22:15

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.13.0 security update

Severity

Important

Scope

24 vulnerabilities in this advisory, including CVE-2023-30841.

CVE-2023-30841

6.0 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Fixed: 4 products Known not affected: 602 products

https://access.redhat.com/errata/RHSA-2023:1326

Open the full advisory

RHSA-2023_6143

Vulnerability from csaf_redhat - Published: 2023-10-26 16:29 - Updated: 2024-12-18 04:50

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.14.0 CNF vRAN extras security update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2023-30841.

CVE-2023-30841

6.0 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Fixed: 1 product Known not affected: 7 products

https://access.redhat.com/errata/RHSA-2023:6143

Open the full advisory

RHSA-2024:3801

Vulnerability from csaf_redhat - Published: 2024-06-11 14:52 - Updated: 2026-10-22 19:46

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.12.58 CNF vRAN extras security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2023-30841.

CVE-2023-30841

6.0 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Fixed: 5 products

https://access.redhat.com/errata/RHSA-2024:3801

Open the full advisory

RHSA-2024_3801

Vulnerability from csaf_redhat - Published: 2024-06-11 14:52 - Updated: 2024-12-16 06:01

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.12.58 CNF vRAN extras security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2023-30841.

CVE-2023-30841

6.0 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Fixed: 5 products

https://access.redhat.com/errata/RHSA-2024:3801

Open the full advisory

WID-SEC-W-2024-1362

Vulnerability from csaf_certbund - Published: 2024-06-11 22:00 - Updated: 2024-12-10 23:00

Summary

Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen und Dateimanipulation

Severity

Hoch

Scope

2 vulnerabilities in this advisory, including CVE-2023-30841.

CVE-2023-30841

Es besteht eine Schwachstelle in Red Hat OpenShift Container Platform. Dieser Fehler betrifft den Baremetal-Operator aufgrund einer unsachgemäßen Behandlung von Authentifizierungsdaten, was zur Offenlegung von Benutzernamen im Klartext und gehashten Passwörtern führt, die als ConfigMaps gespeichert sind. Ein lokaler Angreifer kann diese Sicherheitslücke ausnutzen, um vertrauliche Informationen offenzulegen.

Known affected: 6 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-30841 (GCVE-0-2023-30841)

Impact

Patches

Workarounds

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour