Withdrawn Advisory: OpenShift OAuth Server XSS Vulnerability

TRUNG BÌNH 6.3CVE-2019-3876 · GHSA-jgwg-35hf-xqrr · Công bố 01/04/2019 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2019-3876 là lỗ hổng mức TRUNG BÌNH (CVSS 6.3) ảnh hưởng github.com/openshift/oauth-apiserver, openshift container platform (redhat).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.67%, cao hơn 52.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.11 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/openshift/oauth-apiserver Go	`≥ 3.0, < 3.11`	`3.11`
openshift container platform redhat	`≥ 3.0, ≤ 3.11`	Chưa có bản vá

Mô tả

Withdrawn Advisory

This advisory has been withdrawn because the vulnerability does not affect a package in one of the GitHub Advisory Database's supported ecosystems. This link is maintained to preserve external references.

Original Description

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.

Mô tả của NVD

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.