CVE-2019-10176 describes a Cross-Site Request Forgery (CSRF) vulnerability in OpenShift Container Platform versions 3.11 and later, where CSRF tokens in the cluster console remain static throughout a user's session. This medium-severity flaw (CVSS 5.4) allows an attacker who can observe a token to reuse it for a CSRF attack, potentially leading to low impact on confidentiality and integrity. While the attack complexity is low, it requires user interaction. There is no evidence of active exploitation, public exploit code, or significant community discussion, indicating a low current threat level.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.11CPE matchmatch criteria | cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* | ||
4.1CPE matchmatch criteria | cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.