CVE-2023-4958: Stackrox: missing http security headers allows for clickjacking in web ui
In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.
Other sources
In RHACS 3.63.0 Ui it was found to be is vulnerable to Clickjacking. This is caused due to missing HTTP headers (X-Frame-Options or Content-Security-Policy) this is helping an attacker to load an iframe and trick the user to click and transferred it into their malformed website.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4958?
CVE-2023-4958 is considered a medium severity vulnerability due to the potential for clickjacking attacks.
How do I fix CVE-2023-4958?
To fix CVE-2023-4958, ensure you update to the latest version of Red Hat Advanced Cluster Security, version 3.0 or 4.0, which has addressed this vulnerability.
What is the impact of CVE-2023-4958?
The impact of CVE-2023-4958 includes the possibility of an attacker executing a clickjacking attack on a valid RHACS user.
Which versions of Red Hat Advanced Cluster Security are affected by CVE-2023-4958?
CVE-2023-4958 affects Red Hat Advanced Cluster Security versions 3.0 and 4.0.
How can I mitigate CVE-2023-4958 before applying a fix?
To mitigate CVE-2023-4958, consider implementing security policies to inform users about the risks of clicking on untrusted links.