CVE-2023-4958: fallo de gravedad media en Red Hat Advanced Cluster Security 3
Stackrox: missing http security headers allows for clickjacking in web ui
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.6%
In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Productos afectados
Red Hat · Red Hat Advanced Cluster Security 3Red Hat · Red Hat Advanced Cluster Security 4.2CVEs relacionadas — Red Hat Advanced Cluster Security 3
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-5869HIGHPostgresql: buffer overrun from integer overflow in array modificationEPSS 4.3%CVE-2023-5868MEDIUMPostgresql: memory disclosure in aggregate function callsEPSS 2.8%CVE-2023-5870LOWPostgresql: role pg_signal_backend can signal certain superuser processes.EPSS 2.6%CVE-2023-39417HIGHPostgresql: extension script @substitutions@ within quoting allow sql injectionEPSS 1.7%CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2024-0406MEDIUMMholt/archiver: path traversal vulnerabilityEPSS 0.9%