CVE-2019-10176 — Cross-Site Request Forgery in Redhat Atomic-openshift

CWE-352 — Cross-Site Request Forgery6 documents5 sources
Severity
5.4MEDIUMNVD
CNA4.2
EPSS
0.1%
top 69.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat Atomic-openshiftRedhat Openshift Container Platform
Timeline
PublishedAug 2
Latest updateMay 24

Description

A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain static during a user's session. An attacker with the ability to observe the value of this token would be able to re-use the token to perform a CSRF attack.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages1 packages

▶CVEListV5redhat/atomic-openshiftall versions fixed

Also affects: Openshift Container Platform 3.11, 4.1

🔴Vulnerability Details

2
GHSA
GHSA-2g38-6996-78pm: A flaw was found in OpenShift Container Platform, versions 3↗2022-05-24
▶
CVEList
CVE-2019-10176: A flaw was found in OpenShift Container Platform, versions 3↗2019-08-02
▶

📋Vendor Advisories

1
Red Hat
atomic-openshift: CSRF tokens not refreshing while user is logged in and are exposed in the URL↗2019-07-09
▶

💬Community

2
Bugzilla
CVE-2019-15052 gradle: sends authentication credentials originally destined for the configured host↗2019-09-27
▶
Bugzilla
CVE-2019-10176 atomic-openshift: CSRF tokens not refreshing while user is logged in and are exposed in the URL↗2019-05-21
▶
CVE-2019-10176 — Cross-Site Request Forgery in Redhat | cvebase