Read the docs
TI-2023-04563 Aliases CVE-2023-4958GHSA-2xrv-7wfr-fxj6

Stackrox: missing http security headers allows for clickjacking in web ui

Priority LOW 28CWE-1021Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-1021.

Summary

In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.

Why it matters now

EPSS 0.00629 50th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Advanced Cluster Security 4.2—4.2.0-6Patch availableCNA
Red HatRed Hat Advanced Cluster Security 3——No fix listedCNA
  • Red Hat Advanced Cluster Security 4.2 VendorRed Hat Affected — Fixed in 4.2.0-6 Patch available CNA
  • Red Hat Advanced Cluster Security 3 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:advanced_cluster_security:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:a:redhat:advanced_cluster_security:4.0:*:*:*:*:kubernates:*:*4.0VulnerableRed Hat
  • cpe:2.3:a:redhat:advanced_cluster_security:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:advanced_cluster_security:4.0:*:*:*:*:kubernates:*:* Versions 4.0 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2023:5206 Released 2023-09-18 · Red Hat rating Moderate
    RHACS 4.2 enhancement and security update
    • RHACS 4.2 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Will not fix
RHACS 4.2 for RHEL 8Fixed RHSA-2023:5206
Not affected: 1 product
  • RHACS 4.2 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-4958
  2. 2026-10-03 Alias added: GHSA-2xrv-7wfr-fxj6
  3. 2026-10-28 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2026-23208 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVSS 4.0HIGH 8.7
  • TI-2022-01762 Exposure of resource to wrong sphere in Red Hat Advanced Cluster Security for Kubernetes CVSS 3.1HIGH 8.8
  • TI-2024-00368 Mholt/archiver: path traversal vulnerability CVSS 3.1HIGH 7.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences