CVE-2023-4958

mediumpriority · track · 24EPSS 0.006 · 50 %ileDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.63% (50th) EPSS
CVSS 6.1 · medium
Is it mine?
36 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · nvd · redhat_csaf

EPSS · scored 2026-10-28

In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedadvanced-cluster-security/rhacs-main-rhel8@sha256:301a89cdc5a6aa6cc807851082a0ed58580547098c8fe35e000fe54ecbefcd1e_amd64 as a component of RHACS 4.2 for RHEL 8redhat_csaf

    To take advantage of the new features, bug fixes, and enhancements in RHACS 4.2, you are advised to upgrade to RHACS 4.2.

    https://access.redhat.com/errata/RHSA-2023:5206
  • Fixedadvanced-cluster-security/rhacs-main-rhel8@sha256:64bef5c27321ed50c11018b32ae4d5de3490ad744a0f08e8e724432c75ffa775_s390x as a component of RHACS 4.2 for RHEL 8redhat_csaf

    To take advantage of the new features, bug fixes, and enhancements in RHACS 4.2, you are advised to upgrade to RHACS 4.2.

    https://access.redhat.com/errata/RHSA-2023:5206
  • Fixedadvanced-cluster-security/rhacs-main-rhel8@sha256:e6cd211b07ec198e643043636bc43e32128a99a455594986f54d01f909eb97e1_ppc64le as a component of RHACS 4.2 for RHEL 8redhat_csaf

    To take advantage of the new features, bug fixes, and enhancements in RHACS 4.2, you are advised to upgrade to RHACS 4.2.

    https://access.redhat.com/errata/RHSA-2023:5206
02

cvss

Technical severity, 0–10. One row per scoring source.

6.1
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:Lsecondary · ENISA EU
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:Lsecondary · secalert@redhat.com USexploitability 2.8 · impact 2.7
v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:Lsecondary · Red Hat Product Security US
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1021USCWE-1021US
04

affected products (36)

Products and version ranges known to be affected.

showing 20 of 36
05

advisories (2)

Vendor and ecosystem advisories describing this.

  • RHSA-2023:5206Red Hat Security Advisory: RHACS 4.2 enhancement and security update2023-09-18csaf · redhat_csafUS

    Updated images are now available for Red Hat Advanced Cluster Security (RHACS). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • WID-SEC-W-2023-2394Red Hat Enterprise Linux: Schwachstelle ermöglicht Umgehung von SicherheitsvorkehrungenDeutsch2023-09-19csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, Sicherheitsvorkehrungen zu umgehen.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdnvdredhat_csafcert_bundNVDCVE.orgMITRE
published 2023-12-12modified 2026-06-17
08

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan