CVE-2019-3889

A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 and openshift-enterprise-3.9 through 3.11. An attacker could use this flaw to steal authorization data by getting them to click on a malicious link.

Published: Jul 11, 2019
Updated: Apr 13, 2023
CVE: CVE-2019-3889
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.4
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
redhat / openshift_container_platform	3.9	3.11.x
redhat / openshift_container_platform	3.4	3.7.x
redhat / openshift_container_platform	4.1	4.1.x
redhat / openshift_container_platform	4.2	4.2.x

https://access.redhat.com/errata/RHSA-2019:3722
https://access.redhat.com/errata/RHSA-2019:3770
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3889

Vulnerability Database

CVE-2019-3889