CVE-2017-7534: XSS
It was found that log viewer for a pod doesn't properly handle terminal escape characters and automatic generation of clickable links from output, leading to XSS vulnerability.
Other sources
OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user input, specifically terminal escape characters, and the creation of clickable links automatically when viewing the log files for a pod.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7534?
CVE-2017-7534 has been classified as a medium severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2017-7534?
To fix CVE-2017-7534, update your OpenShift Enterprise installation to the latest version that includes the patch for this vulnerability.
What versions of OpenShift are affected by CVE-2017-7534?
CVE-2017-7534 affects OpenShift Enterprise versions 3.0 through 3.9.
What type of vulnerability is CVE-2017-7534?
CVE-2017-7534 is a stored cross-site scripting (XSS) vulnerability in the log viewer for pods.
Can CVE-2017-7534 lead to data theft?
Yes, CVE-2017-7534 can potentially lead to data theft or manipulation through the execution of malicious scripts.