CVE-2019-10176: CSRF
A flaw was found in atomic-openshift. CSRF tokens are not refreshing while a user is logged in, and they are exposed in the URL. This may allow attackers to perform CSRF attacks successfully.
Other sources
A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain static during a user's session. An attacker with the ability to observe the value of this token would be able to re-use the token to perform a CSRF attack.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10176?
CVE-2019-10176 is classified as a medium severity vulnerability.
How do I fix CVE-2019-10176?
To fix CVE-2019-10176, update your OpenShift Container Platform to version 3.11.25 or higher, or to version 4.1.18 or later.
What systems are affected by CVE-2019-10176?
CVE-2019-10176 affects Red Hat OpenShift Container Platform versions 3.11 and 4.1.
What type of attack does CVE-2019-10176 allow?
CVE-2019-10176 allows attackers to perform Cross-Site Request Forgery (CSRF) attacks due to non-refreshing CSRF tokens.
Can CVE-2019-10176 be exploited remotely?
Yes, CVE-2019-10176 can be exploited remotely if an attacker can trick a user into submitting a request without their consent.