PT-2019-16750 · Red Hat · Openshift Oauth Server
CVE-2019-3876
·
Publicado
2019-04-01
·
Atualizado
2023-02-12
CVSS v3.1
6.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
OpenShift OAuth server (affected versions not specified)
Description
A flaw was found in the "/oauth/token/request" custom endpoint of the OpenShift OAuth server, allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Openshift Oauth Server