Lucene search

K
cve[email protected]CVE-2022-4039
HistorySep 22, 2023 - 3:15 p.m.

CVE-2022-4039

2023-09-2215:15:09
CWE-276
web.nvd.nist.gov
3128
cve-2022-4039
red hat
single sign-on
openshift
security flaw
unsecured management interface
malicious code
sensitive information
nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.7%

A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.

Affected configurations

NVD
Node
redhatsingle_sign-onMatch7.0
Node
redhatopenshift_container_platformMatch4.9
OR
redhatopenshift_container_platformMatch4.10
OR
redhatopenshift_container_platform_for_ibm_zMatch4.9
OR
redhatopenshift_container_platform_for_ibm_zMatch4.10
OR
redhatopenshift_container_platform_for_linuxoneMatch4.9
OR
redhatopenshift_container_platform_for_linuxoneMatch4.10
OR
redhatopenshift_container_platform_for_powerMatch4.9
OR
redhatopenshift_container_platform_for_powerMatch4.10
AND
redhatenterprise_linuxMatch8.0

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "RHEL-8 based Middleware Containers",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "rh-sso-7/sso76-openshift-rhel8",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "7.6-20",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:rhosemc:1.0::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhsso-container-image",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7"
    ]
  }
]

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.7%

Related for CVE-2022-4039