PT-2018-10195 · Red Hat+1 · Tetonic-Console+2

Jason Shepherd · Publicado 2018-09-11 · Atualizado 2019-10-09 · CVE-2018-10937

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Openshift Container Platform version 3.11

Description A cross-site scripting flaw exists in the tetonic-console component. An attacker with the ability to create pods can use this flaw to perform actions on the K8s API as the victim.

Recommendations For Openshift Container Platform version 3.11, consider restricting access to the tetonic-console component until a fix is available. As a temporary workaround, limit the ability to create pods to trusted users to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-10937

Produtos afetados

K8S Api

Openshift Container Platform

Tetonic-Console

Referências · 6

• 🔥 https://github.com/openshift/console/commit/d56666852da6e7309a2e63a49f49a72ff66d309c · Exploit
• https://github.com/openshift/console/pull/461 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10937 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-10937 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-10937 · Aviso do Fabricante
• http://securityfocus.com/bid/105190 · Nota