CVE-2023-4958

mediumPriorität · verfolgen · 24EPSS 0.006 · 50. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.63% (50th) EPSS

CVSS 6.1 · medium

Is it mine?

36 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · nvd · redhat_csaf

EPSS · bewertet 2026-10-28

In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenadvanced-cluster-security/rhacs-main-rhel8@sha256:301a89cdc5a6aa6cc807851082a0ed58580547098c8fe35e000fe54ecbefcd1e_amd64 as a component of RHACS 4.2 for RHEL 8redhat_csaf
To take advantage of the new features, bug fixes, and enhancements in RHACS 4.2, you are advised to upgrade to RHACS 4.2.
https://access.redhat.com/errata/RHSA-2023:5206
Behobenadvanced-cluster-security/rhacs-main-rhel8@sha256:64bef5c27321ed50c11018b32ae4d5de3490ad744a0f08e8e724432c75ffa775_s390x as a component of RHACS 4.2 for RHEL 8redhat_csaf
To take advantage of the new features, bug fixes, and enhancements in RHACS 4.2, you are advised to upgrade to RHACS 4.2.
https://access.redhat.com/errata/RHSA-2023:5206
Behobenadvanced-cluster-security/rhacs-main-rhel8@sha256:e6cd211b07ec198e643043636bc43e32128a99a455594986f54d01f909eb97e1_ppc64le as a component of RHACS 4.2 for RHEL 8redhat_csaf
To take advantage of the new features, bug fixes, and enhancements in RHACS 4.2, you are advised to upgrade to RHACS 4.2.
https://access.redhat.com/errata/RHSA-2023:5206

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 2.7

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:Lsecondary · ENISA EU

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:Lsecondary · secalert@redhat.com USAusnutzbarkeit 2.8 · Auswirkung 2.7

v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:Lsecondary · Red Hat Product Security US

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1021USCWE-1021US

betroffene Produkte (36)

Betroffene Produkte und Versionsbereiche.

Red Hat Red Hat Advanced Cluster Security 4.2< 4.2.0-6enisa_euvdEU
redhat advanced cluster security= 3.0nvdUScpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:*:*:*
redhat advanced cluster security= 4.0nvdUScpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:*:*:*
advanced-cluster-security/rhacs-central-db-rhel8@sha256:655da98b70cce7d0d8eda8c8d13d13e4abb56d240a7dcc86c9a1ecf74524095f_s390x as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS
advanced-cluster-security/rhacs-central-db-rhel8@sha256:a6f0560462f70d081ecd633dab7fe3812a9a05ede057dcfc85c78aebcbfcf7fb_ppc64le as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS
advanced-cluster-security/rhacs-central-db-rhel8@sha256:d53ebe7252d7414e0dc756d48d806504993d43f8c3de2eebed0e1f74749cd2de_amd64 as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS
advanced-cluster-security/rhacs-collector-rhel8@sha256:11ba7bb24a938e34ca077b77730cd1524dee6d81157b7309b0725bde1dc1a658_amd64 as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS
advanced-cluster-security/rhacs-collector-rhel8@sha256:7d6b22c16ffc10dbe11d5d783e1c7efa7f39de054a3a2332c807bdf63bcd1c71_s390x as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS
advanced-cluster-security/rhacs-collector-rhel8@sha256:daec224b2d21db1d0f896c376bc57896f3d322699ea860c9af3daeb0fdf60c26_ppc64le as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS
advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:7cd77dd8ba37e7df2802ef44bda69e4305631729c981a673a0a31433f4d05663_s390x as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS
advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8844ee1cf02d8038e8b156bc856f3f6bbe1cdca160ec79f30da39ef826d897f2_amd64 as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS
advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:99cea72009375b9fe0d351d2dc74d0b08f303daf8fd3d054f34301b2a7b9874e_ppc64le as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS
advanced-cluster-security/rhacs-main-rhel8@sha256:301a89cdc5a6aa6cc807851082a0ed58580547098c8fe35e000fe54ecbefcd1e_amd64 as a component of RHACS 4.2 for RHEL 8alle Versionenfixedredhat_csafUS
advanced-cluster-security/rhacs-main-rhel8@sha256:64bef5c27321ed50c11018b32ae4d5de3490ad744a0f08e8e724432c75ffa775_s390x as a component of RHACS 4.2 for RHEL 8alle Versionenfixedredhat_csafUS
advanced-cluster-security/rhacs-main-rhel8@sha256:e6cd211b07ec198e643043636bc43e32128a99a455594986f54d01f909eb97e1_ppc64le as a component of RHACS 4.2 for RHEL 8alle Versionenfixedredhat_csafUS
advanced-cluster-security/rhacs-operator-bundle@sha256:85b9f7b20c8ad9552c30f6aaf772ceb5342bcf6ea90ea997eb614212fa57ed58_s390x as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS
advanced-cluster-security/rhacs-operator-bundle@sha256:de3b2e28150c6428864fe8dd7ef325b806bc9e9881d883ba3335e00b6593618c_amd64 as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS
advanced-cluster-security/rhacs-operator-bundle@sha256:e2262de639260486a1942d9c7a8be075a96888519c65b0ccd41f1360978300ac_ppc64le as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS
advanced-cluster-security/rhacs-rhel8-operator@sha256:696ef8ccb59d3f34a640ffdc18b089680a2a28189b388450080454865ce5b12e_amd64 as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS
advanced-cluster-security/rhacs-rhel8-operator@sha256:d80fafb9e7fcd0fa9e4103ae929cfa9dc8b91851b50d17d377d8fbdf2dd0884f_s390x as a component of RHACS 4.2 for RHEL 8alle Versionennot affectedredhat_csafUS

20 von 36 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2023:5206Red Hat Security Advisory: RHACS 4.2 enhancement and security update2023-09-18csaf · redhat_csafUS
Updated images are now available for Red Hat Advanced Cluster Security (RHACS). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2023-2394Red Hat Enterprise Linux: Schwachstelle ermöglicht Umgehung von SicherheitsvorkehrungenDeutsch2023-09-19csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, Sicherheitsvorkehrungen zu umgehen.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd redhat_csaf cert_bund NVD CVE.org MITRE

veröffentlicht 2023-12-12geändert 2026-06-17

Referenzen (11)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan