PT-2023-1508 · Red Hat · Red Hat Single Sign-On

Chess Hazlett + 1 · Publicado 2023-03-01 · Atualizado 2023-09-26 · CVE-2022-4039

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Hat Single Sign-On for OpenShift container images (affected versions not specified)

Description A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration. The issue is related to the default access control settings of the Keycloak identity and access management tool, which can be exploited by a remote attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

BDU:2023-00935

CVE-2022-4039

Produtos afetados

Red Hat Single Sign-On

Referências · 11

• https://access.redhat.com/errata/RHSA-2023:1047 · Aviso do Fabricante
• https://twitter.com/DMFezzaReedCISA/status/1705253973324714238 · Publicação no Twitter
• https://access.redhat.com/security/cve/CVE-2022-4039 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1705223997254730219 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-00935 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=2143416 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-4039 · Nota de Segurança
• https://t.me/cibsecurity/70948 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-4039 · Aviso do Fabricante
• https://t.me/cvenotify/58596 · Publicação no Telegram
• https://access.redhat.com/security/cve/cve-2022-4039 · Nota