PT-2018-10195 · Red Hat+1 · Tetonic-Console+2

Jason Shepherd · Published 2018-09-11 · Updated 2019-10-09 · CVE-2018-10937

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Openshift Container Platform version 3.11

Description A cross-site scripting flaw exists in the tetonic-console component. An attacker with the ability to create pods can use this flaw to perform actions on the K8s API as the victim.

Recommendations For Openshift Container Platform version 3.11, consider restricting access to the tetonic-console component until a fix is available. As a temporary workaround, limit the ability to create pods to trusted users to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-10937

Affected Products

K8S Api

Openshift Container Platform

Tetonic-Console

References · 6

• 🔥 https://github.com/openshift/console/commit/d56666852da6e7309a2e63a49f49a72ff66d309c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-10937 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10937 · Vendor Advisory
• https://github.com/openshift/console/pull/461 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10937 · Note
• http://securityfocus.com/bid/105190 · Note