Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Openshift-console: oauth2 insufficient state parameter entropy (openshift-console)

CVE-2024-6508
HIGH 8.0

En bref

Source
NVD
EPSS
EPSS 0.67 % · centile 52 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
redhat
Statut NVD
Deferred

Rechercher sur…

Description

An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions.

Faiblesses (CWE)

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 8.0CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:Hredhat
CVSS 3.1HIGH 8.0CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:HNVD · secalert@redhat.com (Secondary)

Avis

Références européennes

Produits affectés

ProduitVersions
openshift-console
Red Hat · Red Hat OpenShift Container Platform 4.12unaffected v4.12.0-202412201659.p0.g8910d84.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13unaffected v4.13.0-202411300029.p0.g68accd9.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202411131205.p0.g839a801.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.15unaffected v4.15.0-202411060036.p0.gd8360d4.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.16unaffected v4.16.0-202410231737.p0.gf0870c3.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.17unaffected v4.17.0-202410091535.p0.ge61f187.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202501230001.p0.g088dcaf.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202501230001.p0.gd4fb1b6.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202501230001.p0.g11ced00.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202501230001.p0.gf648c78.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202501230001.p0.g24a6532.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202502100301.p0.g2e139ed.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202501230001.p0.g3193a75.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202502041302.p0.g1ad8f2e.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202501230001.p0.g7149f2d.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202501230001.p0.g7149f2d.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202501230001.p0.g962ccca.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202501230001.p0.gba2234b.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202502111035.p0.gf76635f.assembly.stream.el9 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD