CVE-2019-3876

published 2019-04-01

CVE-2019-3876: A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing…

medium 6.3 CVSS 3.1

AV N AC L PR N UI R S U C L I L A L

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
github.com	openshift_oauth-apiserver	>= 3.0 < 3.11	3.11
red_hat	web-console	—	—
redhat	openshift_container_platform	3.0 – 3.11	—

CWE-352