CVE-2023-1065

MEDIUM
Published Feb 28, 20233y ago · Modified Jun 17, 20261w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Feb 28, 2023 3y ago
Last Modified Jun 17, 2026 1w ago

Description

This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues. It does not expose the user of the integration to any direct security risk and no user data can be leaked. To exploit the vulnerability the attacker does not need to be authenticated to Snyk but does need to know the target's Integration ID (which may or may not be the same as the Organization ID, although this is an unpredictable UUID in either case).

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-287 Improper Authentication Authentication

Affected Products 1

VendorProductVersionRange
snykkubernetes_monitor* <2.0.0

References 4

  • github.com https://github.com/snyk/kubernetes-monitor
    Product
  • github.com https://github.com/snyk/kubernetes-monitor/commit/5b9a7821680bbfb6c4a900ab05d898ce2b2cc157
    Patch
  • github.com https://github.com/snyk/kubernetes-monitor/pull/1275
    Patch
  • snyk.io https://snyk.io/blog/api-auth-vuln-snyk-kubernetes-cve-2023-1065/
    Vendor Advisory

Remediation

  • github.com https://github.com/snyk/kubernetes-monitor/commit/5b9a7821680bbfb6c4a900ab05d898ce2b2cc157
    Patch
  • github.com https://github.com/snyk/kubernetes-monitor/pull/1275
    Patch