VULNERABILITY INTELLIGENCE

CVE-2023-4958

CVSS score6.1 MEDIUM
EPSS probability0.63%
CISA KEVNot currently listed
Published2023-12-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Description

In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.

Weakness classification

  • secalert@redhat.com: CWE-1021
  • nvd@nist.gov: CWE-1021

Primary references