title: Missing http security headers allows for clickjacking in web ui
description: In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.
problem types: Improper Neutralization of Special Elements used in a Command ('Command Injection')
affected:
{
product: rhacs-main-container
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: Red Hat Advanced Cluster Security 4.2
collectionURL: https://catalog.redhat.com/software/containers/
packageName: advanced-cluster-security/rhacs-main-rhel8
defaultStatus: affected
versions:
version: 4.2.0-6, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:advanced_cluster_security:4.2::el8
}
{
vendor: Red Hat
product: Red Hat Advanced Cluster Security 3
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: advanced-cluster-security/rhacs-main-rhel8
defaultStatus: affected
cpes: cpe:/a:redhat:advanced_cluster_security:3
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]