CVE-2019-3876

MEDIUM

OpenShift Container Platform 3.0-3.11 - Cross-Site Request Forgery in OAuth Token Request Endpoint

Title source: llm

Description

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/107664

Third Party Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2019:1851

Issue Tracking, Vendor Advisory x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3876

Scores

CVSS v3 6.3

EPSS 0.0012

EPSS Percentile 31.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Details

CWE

CWE-352

Status published

Products (2)

openshift/oauth-apiserver 3.0 - 3.11Go

redhat/openshift_container_platform 3.0 - 3.11

Published Apr 01, 2019

Tracked Since Feb 18, 2026