CVE-2022-4039: Rhsso-container-image: unsecured management interface exposed to adjecent network
A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.
Other sources
It was found that Keycloak instances launched by the Operator are configured with an unsecured management interface enabled. An attacker could use this interface to deploy malicious code, as well as access and modify potentially sensitive information in the app server configuration.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2022-4039.
What is the severity of CVE-2022-4039?
The severity of CVE-2022-4039 is critical with a CVSS score of 9.8.
Which software is affected by CVE-2022-4039?
Red Hat Single Sign-On for OpenShift container images with an unsecured management interface enabled is affected by CVE-2022-4039.
How can an attacker exploit CVE-2022-4039?
An attacker can exploit CVE-2022-4039 by using the unsecured management interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.
Is there a fix available for CVE-2022-4039?
Yes, a fix is available for CVE-2022-4039. It is recommended to update to Red Hat Single Sign-On version 7.6.2.