A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2023:1047 | Vendor Advisory |
| https://access.redhat.com/security/cve/CVE-2022-4039 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2143416 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
| AND |
|
History
26 Sep 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-276 | |
| First Time |
Redhat single Sign-on
Redhat openshift Container Platform For Linuxone Redhat openshift Container Platform For Power Redhat openshift Container Platform Redhat openshift Container Platform For Ibm Z Redhat Redhat enterprise Linux |
|
| CPE | cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.10:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.9:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* |
|
| References | (MISC) https://access.redhat.com/security/cve/CVE-2022-4039 - Vendor Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2143416 - Issue Tracking, Vendor Advisory | |
| References | (MISC) https://access.redhat.com/errata/RHSA-2023:1047 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
22 Sep 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-22 15:15
Updated : 2023-12-10 15:14
NVD link : CVE-2022-4039
Mitre link : CVE-2022-4039
CVE.ORG link : CVE-2022-4039
JSON object : View
Products Affected
redhat
- single_sign-on
- enterprise_linux
- openshift_container_platform_for_linuxone
- openshift_container_platform
- openshift_container_platform_for_power
- openshift_container_platform_for_ibm_z
CWE
CWE-276
Incorrect Default Permissions