| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/openshift/oauth-apiserver | ≥ 3.0, < 3.11 | 3.11 |
| openshift container platform | ≥ 3.0, ≤ 3.11 |
This advisory has been withdrawn because the vulnerability does not affect a package in one of the GitHub Advisory Database's supported ecosystems. This link is maintained to preserve external references.
A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free