Vulnerability Details : CVE-2023-4958
In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.
Products affected by CVE-2023-4958
- cpe:2.3:a:redhat:advanced_cluster_security:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:advanced_cluster_security:4.0:*:*:*:*:kubernates:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-4958
0.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 31 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-4958
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST | |
|
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L |
2.8
|
2.7
|
Red Hat, Inc. |
CWE ids for CVE-2023-4958
-
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.Assigned by: secalert@redhat.com (Secondary)
-
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.Assigned by:
- nvd@nist.gov (Secondary)
- secalert@redhat.com (Primary)
References for CVE-2023-4958
-
https://access.redhat.com/errata/RHSA-2023:5206
RHSA-2023:5206 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://access.redhat.com/security/cve/CVE-2023-4958
CVE-2023-4958- Red Hat Customer PortalVendor Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1990363
1990363 – (CVE-2023-4958) CVE-2023-4958 stackrox: Missing HTTP security headers allows for clickjacking in web UIIssue Tracking;Patch
Jump to