PT-2020-14960 · Red Hat · Openshift Container Platform

Published 2020-04-24 · Updated 2023-02-12 · CVE-2020-1741

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenShift Container Platform versions 3.11

Description A flaw was found in the way OpenShift Container Platform specified CORS allowed origins during installation, making it too permissive. This could allow an attacker, able to man-in-the-middle the connection between the user's browser and the OpenShift console, to perform a phishing attack. The main threat from this issue is data confidentiality.

Recommendations For OpenShift Container Platform version 3.11, consider restricting access to the OpenShift console to minimize the risk of exploitation until a more secure configuration can be applied. As a temporary workaround, review and adjust the CORS allowed origins configuration to be more restrictive. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-185

CWE-697

Related Identifiers

CVE-2020-1741

RHSA-2020:3541

Affected Products

Openshift Container Platform

References · 4

• https://osv.dev/vulnerability/CVE-2020-1741 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1741 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1741 · Security Note
• https://t.me/cvenotify/3208 · Telegram Post