Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4016 State: PUBLISHED Published: 2022-12-12T17:57:10.870Z Last Updated: 2025-04-22T14:41:03.625Z Vendors: Unknown Products: Booster for WooCommerce, Booster Plus for WooCommerce, Booster Elite for WooCommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress plugin before 1.1.8 does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins create and delete arbitrary custom roles via CSRF attacks Additional Analyst Notes: - CVE Program Container:
gged admins create and delete arbitrary custom roles via CSRF attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9b77044c-fd3f-4e6f-a759-dcc3082dcbd6
CVE ID: CVE-2022-4017 State: PUBLISHED Published: 2023-01-23T14:31:54.638Z Last Updated: 2025-04-02T15:29:35.234Z Vendors: Unknown Products: Booster for WooCommerce, Booster Plus for WooCommerce, Booster Elite for WooCommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress plugin before 6.0.1 have either flawed CSRF checks or are missing them completely in numerous places, allowing attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CVE Program Container: - CISA
ake logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/609072d0-9bb9-4fe0-9626-7e4a334ca3a4
CVE ID: CVE-2022-4018 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-14T18:58:13.559Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-306 Description: Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ikus060/rdiffweb/commit/f2a32f2a9f3fb8be1a9432ac3d81d3aacdb13095 - https://huntr.dev/bounties/5340c2f6-0252-40f6-8929-cca5d64958a5
CVE ID: CVE-2022-4019 State: PUBLISHED Published: 2022-11-23T05:32:15.495Z Last Updated: 2024-12-06T23:07:36.133Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Playbooks Plugin Problem Types: CWE-770 Description: A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/ - https://hackerone.com/reports/1685979
CVE ID: CVE-2022-4020 State: PUBLISHED Published: 2022-11-28T13:00:01.057Z Last Updated: 2025-04-14T18:16:59.908Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H) Vendors: Acer Products: Aspire A315-22, Aspire A115-21, Aspire A315-22G, Extensa EX215-21, Extensa EX215-21G Problem Types: CWE-276 Description: Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vu
CISA ADP Vulnrichment: References: - https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings
CVE ID: CVE-2022-4021 State: PUBLISHED Published: 2022-11-16T13:16:22.124Z Last Updated: 2025-01-31T18:25:18.430Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: mbis Products: Permalink Manager Lite Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This is due to missing or incorrect nonce validation on the extra_actions function. This makes it possible for unauthenticated attackers to change plugin settings including permalinks and site maps, via forged request granted they can trick a site administrator
ange plugin settings including permalinks and site maps, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset/2818142#file34 - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4021
CVE ID: CVE-2022-4022 State: PUBLISHED Published: 2022-11-16T13:23:44.784Z Last Updated: 2025-02-07T20:32:49.213Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: benbodhi Products: SVG Support Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. SVG files containing malicious javascript are not sanitized. While version 2.5 adds the ability to sanitize image as they are uploaded, the plugin defaults to disable sanitization and does not restrict SVG upload to only administrators. This allows authenticat
plugin defaults to disable sanitization and does not restrict SVG upload to only administrators. This allows authenticated attackers, with author-level privileges and higher, to upload malicious SVG files that can be embedded in posts and pages by higher privileged users. Additionally, the embedded JavaScript is also triggered on visiting the image URL, which allows an attacker to execute malicious code in browsers visiting that URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2776612%40svg-support%2Ftrunk&old=2672900%40svg-support%2Ftrunk&sfp_email=&sfph_mail= - htt
il=&sfph_mail=&reponame=&new=2776612%40svg-support%2Ftrunk&old=2672900%40svg-support%2Ftrunk&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4022
CVE ID: CVE-2022-4023 State: PUBLISHED Published: 2023-07-17T13:29:47.733Z Last Updated: 2024-10-30T15:07:07.035Z Vendors: Unknown Products: 3dprint Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into submitting a form. Furthermore the created archive has a predictable location and name, allowing the attacker to download the file if they know the time at which the
hive has a predictable location and name, allowing the attacker to download the file if they know the time at which the form was submitted, making it possible to leak sensitive files like the WordPress configuration containing database credentials and secrets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/859c6e7e-2381-4d93-a526-2000b4fb8fee - https://jetpack.com/blog/vulnerabilities-found-in-the-3dprint-premium-plugin/
CVE ID: CVE-2022-4024 State: PUBLISHED Published: 2022-12-19T13:41:40.069Z Last Updated: 2025-04-17T14:15:50.693Z Vendors: Unknown Products: Registration Forms Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a087fb45-6f6c-40ac-b48b-2cbceda86cbe
CVE ID: CVE-2022-4025 State: PUBLISHED Published: 2023-01-02T00:00:00 Last Updated: 2024-10-29T15:23:42.828Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data outside an iframe via a crafted HTML page. (Chrome security severity: Low) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html - https://crbug.com/1260250
CVE ID: CVE-2022-4027 State: PUBLISHED Published: 2022-11-29T20:06:05.069Z Last Updated: 2025-02-07T20:31:38.120Z Severity: HIGH (CVSS 7.2 CVSS:3.1/A:N/I:L/C:L/S:C/UI:N/PR:N/AC:L/AV:N) Vendors: simplepress Products: Simple:Press – WordPress Forum Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during a forum response in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for u
input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when responding to forum threads that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4027
CVE ID: CVE-2022-4028 State: PUBLISHED Published: 2022-11-29T20:08:35.119Z Last Updated: 2025-02-07T20:31:10.596Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/A:N/I:L/C:L/S:C/UI:N/PR:L/AC:L/AV:N) Vendors: simplepress Products: Simple:Press – WordPress Forum Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action when modifying a profile signature in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed
to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to inject arbitrary web scripts in pages when modifying a profile signature that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4028
CVE ID: CVE-2022-4029 State: PUBLISHED Published: 2022-11-29T20:10:24.741Z Last Updated: 2025-02-07T20:30:43.303Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/A:N/I:L/C:L/S:C/UI:R/PR:N/AC:H/AV:N) Vendors: simplepress Products: Simple:Press – WordPress Forum Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple:Press plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sforum_[md5 hash of the WordPress URL]' cookie value in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web s
t input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This would be highly complex to exploit as it would require the attacker to set the cookie a cookie for the targeted user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4029
CVE ID: CVE-2022-4030 State: PUBLISHED Published: 2022-11-29T20:13:25.260Z Last Updated: 2025-01-23T21:24:32.361Z Severity: HIGH (CVSS 8.1 CVSS:3.1/A:H/I:H/C:N/S:U/UI:N/PR:L/AC:L/AV:N) Vendors: simplepress Products: Simple:Press – WordPress Forum Plugin Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'file' parameter which can be manipulated during user avatar deletion. This makes it possible with attackers, with minimal permissions such as a subscriber, to supply paths to arbitrary files on the server that will
th attackers, with minimal permissions such as a subscriber, to supply paths to arbitrary files on the server that will subsequently be deleted. This can be used to delete the wp-config.php file that can allow an attacker to configure the site and achieve remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4030
CVE ID: CVE-2022-4031 State: PUBLISHED Published: 2022-11-29T20:15:59.914Z Last Updated: 2025-01-23T21:23:30.526Z Severity: LOW (CVSS 3.8 CVSS:3.1/A:L/I:L/C:N/S:U/UI:N/PR:H/AC:L/AV:N) Vendors: simplepress Products: Simple:Press – WordPress Forum Plugin Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parameter which does not properly restrict files to be edited in the context of the plugin. This makes it possible with attackers, with high-level permissions such as an administrator, to supply p
of the plugin. This makes it possible with attackers, with high-level permissions such as an administrator, to supply paths to arbitrary files on the server that can be modified outside of the intended scope of the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4031
CVE ID: CVE-2022-4032 State: PUBLISHED Published: 2022-11-29T20:23:15.308Z Last Updated: 2025-01-23T21:22:40.015Z Severity: HIGH (CVSS 7.2 CVSS:3.1/A:N/I:L/C:L/S:C/UI:N/PR:N/AC:L/AV:N) Vendors: expresstech Products: Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress Problem Types: CWE-20 Improper Input Validation Description: The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that allowed iframe tags to be injected. This makes it possible for unauthenticated attackers to inject iFrames in pages that will execu
ame tags to be injected. This makes it possible for unauthenticated attackers to inject iFrames in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2801761%40quiz-master-next&new=2801761%40quiz-master-next&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4032
CVE ID: CVE-2022-4033 State: PUBLISHED Published: 2022-11-29T20:25:26.881Z Last Updated: 2025-01-23T21:21:19.029Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/A:N/I:L/C:N/S:U/UI:N/PR:N/AC:L/AV:N) Vendors: expresstech Products: Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress Problem Types: CWE-20 Improper Input Validation Description: The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value (i.e. a number, file path, etc..). This makes it possible attackers to submit
ct content other than the specified value (i.e. a number, file path, etc..). This makes it possible attackers to submit values other than the intended input type. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2801761%40quiz-master-next&new=2801761%40quiz-master-next&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4033
CVE ID: CVE-2022-4034 State: PUBLISHED Published: 2022-11-29T20:30:15.537Z Last Updated: 2025-01-23T21:20:45.510Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/A:L/I:L/C:L/S:C/UI:R/PR:N/AC:H/AV:N) Vendors: codepeople Products: Appointment Hour Booking – WordPress Booking Plugin Problem Types: CWE-1236 Improper Neutralization of Formula Elements in a CSV File Description: The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's administrator exports booking details. This can r
ring booking creation that may be exported as a CSV file when a site's administrator exports booking details. This can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40appointment-hour-booking&new=2803896%40appointment-hour-booking&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4034
CVE ID: CVE-2022-4035 State: PUBLISHED Published: 2022-11-29T20:32:28.799Z Last Updated: 2025-01-23T21:19:29.313Z Severity: HIGH (CVSS 7.2 CVSS:3.1/A:N/I:L/C:L/S:C/UI:N/PR:N/AC:L/AV:N) Vendors: codepeople Products: Appointment Hour Booking – WordPress Booking Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping that makes injecting iFrame tags possible. This makes it possible for unauthenticated
t sanitization and output escaping that makes injecting iFrame tags possible. This makes it possible for unauthenticated attackers to inject iFrames when submitting a booking that will execute whenever a user accesses the injected booking details page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40appointment-hour-booking&new=2803896%40appointment-hour-booking&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4035
CVE ID: CVE-2022-4036 State: PUBLISHED Published: 2022-11-29T20:34:59.668Z Last Updated: 2025-01-23T21:18:54.672Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/A:N/I:N/C:L/S:U/UI:N/PR:N/AC:L/AV:N) Vendors: codepeople Products: Appointment Hour Booking – WordPress Booking Plugin Problem Types: CWE-804 Guessable CAPTCHA Description: The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordp
ie. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40appointment-hour-booking&new=2803896%40appointment-hour-booking&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4036
CVE ID: CVE-2022-4037 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T16:22:03.062Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Time-of-check time-of-use (toctou) race condition in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth provider. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
sing GitLab as an OAuth provider. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/382957 - https://hackerone.com/reports/1772543 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4037.json
CVE ID: CVE-2022-4038 State: REJECTED Published: N/A Last Updated: 2024-07-29T19:55:15.579Z Description: No description available.
CVE ID: CVE-2022-4039 State: PUBLISHED Published: 2023-09-22T14:00:39.803Z Last Updated: 2024-09-24T14:29:55.579Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: RHEL-8 based Middleware Containers, Red Hat Single Sign-On 7 Problem Types: CWE-276 Description: A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
on in the app server configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:1047 - https://access.redhat.com/security/cve/CVE-2022-4039 - https://bugzilla.redhat.com/show_bug.cgi?id=2143416