CVE-2023-4958

    Dashboard / Vulnerabilities / CVE-2023-4958

    CVE-2023-4958

    Published: 12 Dec 2023Last Modified: 28 Oct 2026

    Summary: Stackrox: missing http security headers allows for clickjacking in web ui

    Details: In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.

    References: https://access.redhat.com/downloads/content/package-browser/, https://catalog.redhat.com/software/containers/, https://access.redhat.com/errata/RHSA-2023:5206, https://access.redhat.com/security/cve/CVE-2023-4958, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4958.json, https://nvd.nist.gov/vuln/detail/CVE-2023-4958, https://bugzilla.redhat.com/show_bug.cgi?id=1990363

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 63fce4eb4d89f3a88734d1950a128a02b0abcf74
    Fixed -None

    Affected versions

    4.0
    4.0.x

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-4958 | CVE-DB