CVE-2022-3260 Security feature bypass in Openshift

What is CVE-2022-3260?

CVE-2022-3260 is a medium-severity vulnerability in Redhat Openshift, published on 8 Dec 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these results incorrectly, allowing clickjacking attacks.

Weakness: CWE-1021

Which versions are affected by CVE-2022-3260?

It affects 1 product.

Products include Redhat Openshift.

How do I fix CVE-2022-3260?

No fix has been published for CVE-2022-3260 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-3260 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3260 exists.

Other vulnerabilities in Redhat Openshift

• CVE-2014-3496 Command injection in n/a Critical 10.0
• CVE-2014-0234 Hardcoded credentials in Red Hat OpenShift Enterprise Critical 9.8
• CVE-2013-2060 Command injection in OpenShift Origin Critical 9.8
• CVE-2013-4561 Path traversal in openshift-origin-msg-node-mcollective Critical 9.1
• CVE-2014-0163 Command injection in Openshift High 8.8

All Redhat Openshift vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v9rj-m949-r3xx.