CVE-2022-4039

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
Red Hat	RHEL-8 based Middleware Containers	—
Red Hat	Red Hat Single Sign-On 7	—

References

https://access.redhat.com/errata/RHSA-2023:1047Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-4039Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2143416Issue Tracking, Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1047Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-4039Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2143416Issue Tracking, Vendor Advisory

Timeline

Published: Sep 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-404028.8Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_assign.php.CVE-2022-404037.2Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/feature_edit.php.CVE-2022-404048.8Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/select.php.CVE-2022-404057.5WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=l CVE-2022-404078.8A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.CVE-2022-404085.4FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box und CVE-2022-40418.8Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privil CVE-2022-40424.8The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could a CVE-2022-404249.8The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code ex CVE-2022-404259.8The d8s-html for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the CVE-2022-404269.8The d8s-asns for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the CVE-2022-404279.8The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is