VulnerabilityModified
CVE-2022-4039
This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.
CRITICAL 9.8EPSS 0.79%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.79%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.79% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-276
- Affected
- redhat/single sign-on · redhat/openshift container platform · redhat/openshift container platform for ibm z · redhat/openshift container platform for linuxone · redhat/openshift container platform for power
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2023:1047Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-4039Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2143416Issue Tracking, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:1047Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-4039Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2143416Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.