CVE-2022-4039

HIGH

Red Hat Single Sign-On - Unauthenticated Incorrect Default Permissions in Management Interface

Title source: llm
STIX 2.1

Description

A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2023:1047
Vendor Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2022-4039
Issue Tracking, Vendor Advisory issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2143416

Scores

CVSS v3 8.0
EPSS 0.0012
EPSS Percentile 30.7%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-276
Status published
Products (9)
redhat/openshift_container_platform 4.9
redhat/openshift_container_platform 4.10
redhat/openshift_container_platform_for_ibm_z 4.9
redhat/openshift_container_platform_for_ibm_z 4.10
redhat/openshift_container_platform_for_linuxone 4.9
redhat/openshift_container_platform_for_linuxone 4.10
redhat/openshift_container_platform_for_power 4.9
redhat/openshift_container_platform_for_power 4.10
redhat/single_sign-on 7.0
Published Sep 22, 2023
Tracked Since Feb 18, 2026