CVE-2022-3259

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-665

Affected software

VendorProductVersions
n/aOpenShift4.9.0

References

Timeline

Published
Dec 9, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-325906.7In wlan, there is a possible use after free due to an incorrect status check. This could lead to local escalation of privilege with System eCVE-2022-325917.5In ril, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service with no additional exCVE-2022-325926.7In cpu dvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SyCVE-2022-325936.7In vowe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SystemCVE-2022-325946.7In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege withCVE-2022-325954.4In widevine, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with SCVE-2022-325966.7In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege withCVE-2022-325976.7In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege withCVE-2022-325986.7In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege withCVE-2022-325996.7In rpmb, there is a possible out of bounds write due to a logic error. This could lead to local escalation of privilege with System executioCVE-2022-32604.8The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these CVE-2022-326017.8In telephony, there is a possible permission bypass due to a parcel format mismatch. This could lead to local escalation of privilege with n
CVE-2022-3259: High severity, CVSS 7.4 | Vulnix