Rhsso-container-image: unsecured management interface exposed to adjecent network (Red Hat RHEL-8 based Middleware Containers)
En bref
- Source
- NVD
- EPSS
- EPSS 0.79 % · centile 56 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Rechercher sur…
Description
A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.
Faiblesses (CWE)
- CWE-276 — Permissions par défaut incorrectes
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | redhat |
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2022-51418
- GCVE · GCVE-0-2022-4039
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.9:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.10:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Red Hat · RHEL-8 based Middleware Containers | unaffected 7.6-20 < * |
| Red Hat · Red Hat Single Sign-On 7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |