CVE-2022-4039
Assigner: redhat
Published: 2023-09-22T14:00:39.803Z
State: PUBLISHED
title: Rhsso-container-image: unsecured management interface exposed to adjecent network
metrics: other: content: value: Important
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
descriptions: value: A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.
affected: vendor: Red Hat
product: RHEL-8 based Middleware Containers
collectionURL: https://catalog.redhat.com/software/containers/
packageName: rh-sso-7/sso76-openshift-rhel8
defaultStatus: affected
versions: version: 7.6-20
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:rhosemc:1.0::el8
vendor: Red Hat
product: Red Hat Single Sign-On 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rhsso-container-image
defaultStatus: affected
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
datePublic: 2023-02-28T21:26:00+00:00
problemTypes: descriptions: cweId: CWE-276
description: Incorrect Default Permissions
type: CWE
x_redhatCweChain: CWE-276: Incorrect Default Permissions
timeline: time: 2022-11-15T00:00:00+00:00
value: Reported to Red Hat.
time: 2023-02-28T21:26:00+00:00
value: Made public.
credits: value: This issue was discovered by Thibault Guittet (Red Hat).