CVE-2019-3876

Опубликовано: 01 апр. 2019

Источник: nvd

CVSS3: 5

CVSS3: 6.3

CVSS2: 4.3

EPSS Низкий

Описание

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.

Ссылки

http://www.securityfocus.com/bid/107664
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:1851
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3876
Issue Tracking
Vendor Advisory
http://www.securityfocus.com/bid/107664
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:1851
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3876
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*

Версия от 3.0 (включая) до 3.11 (включая)

EPSS

Процентиль: 42%

0.00199

Низкий

5 Medium

CVSS3

6.3 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

CVE-2019-3876

CVSS3: 5

redhat

почти 7 лет назад

GHSA-jgwg-35hf-xqrr

CVSS3: 6.3

github

больше 3 лет назад

Withdrawn Advisory: OpenShift OAuth Server XSS Vulnerability

EPSS

Процентиль: 42%

0.00199

Низкий

5 Medium

CVSS3

6.3 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352