CVE-2023-4958: medium-severity vulnerability in Red Hat Advanced Cluster Security 3
Stackrox: missing http security headers allows for clickjacking in web ui
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.6%
In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Affected products
Red Hat · Red Hat Advanced Cluster Security 3Red Hat · Red Hat Advanced Cluster Security 4.2Related CVEs — Red Hat Advanced Cluster Security 3
In the same product, most dangerous first.
CVE-2023-5869HIGHPostgresql: buffer overrun from integer overflow in array modificationEPSS 4.3%CVE-2023-5868MEDIUMPostgresql: memory disclosure in aggregate function callsEPSS 2.8%CVE-2023-5870LOWPostgresql: role pg_signal_backend can signal certain superuser processes.EPSS 2.6%CVE-2023-39417HIGHPostgresql: extension script @substitutions@ within quoting allow sql injectionEPSS 1.7%CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2024-0406MEDIUMMholt/archiver: path traversal vulnerabilityEPSS 0.9%