CVE-2023-30841

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-319

Affected software

VendorProductVersions
metal3-iobaremetal-operator< 0.3.0

References

Timeline

Published
Apr 26, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-308436.5Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that conCVE-2023-308448.8Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutaCVE-2023-308459.8ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 containsCVE-2023-308467.5typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library vCVE-2023-308478.2H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP rCVE-2023-308488.8Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vCVE-2023-308498.8Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the traCVE-2023-30856.1A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504. This issue affects the functioCVE-2023-308508.8Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admCVE-2023-308515.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP polCVE-2023-308524.9Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint thaCVE-2023-308536.5Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using