Vulnerability · Published Dec 12, 2023 · Assigned by redhat

CVE-2023-4958Stackrox: missing http security headers allows for clickjacking in web ui

Medium 6.1

In plain English

A medium-severity security flaw in Red Hat Advanced Cluster Security 3 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.6%top 49.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Advanced Cluster Security 4.2	see references
Red Hat	Red Hat Advanced Cluster Security 3	see references

Weakness: CWE-1021 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

References

RHSA-2023:5206 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-4958 vdb-entry, x_refsource_REDHAT
RHBZ#1990363 issue-tracking, x_refsource_REDHAT