A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2023:1047 | Vendor Advisory |
| https://access.redhat.com/security/cve/CVE-2022-4039 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2143416 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
| AND |
|
History
26 Sep 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://access.redhat.com/errata/RHSA-2023:1047 - Vendor Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2143416 - Issue Tracking, Vendor Advisory | |
| References | (MISC) https://access.redhat.com/security/cve/CVE-2022-4039 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Redhat openshift Container Platform
Redhat openshift Container Platform For Linuxone Redhat single Sign-on Redhat Redhat openshift Container Platform For Ibm Z Redhat enterprise Linux Redhat openshift Container Platform For Power |
|
| CPE | cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.10:*:*:*:*:*:*:* cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.9:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:* |
|
| CWE | CWE-276 |
22 Sep 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-22 15:15
Updated : 2024-02-28 20:33
NVD link : CVE-2022-4039
Mitre link : CVE-2022-4039
CVE.ORG link : CVE-2022-4039
JSON object : View
Products Affected
redhat
- enterprise_linux
- openshift_container_platform_for_ibm_z
- openshift_container_platform_for_power
- openshift_container_platform
- openshift_container_platform_for_linuxone
- single_sign-on
CWE
CWE-276
Incorrect Default Permissions