CVE-2020-10715: Input Validation
A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. This flaw allows an attacker to craft a URL and inject arbitrary text onto the error page that appears to be from the OpenShift instance. This attack could potentially convince a user that the inserted text is legitimate.
Other sources
A content spoofing vulnerability was found in the openshift/console. This flaw allows an attacker to craft a URL and inject arbitrary text onto the error page that appears to be from the OpenShift instance. This attack could potentially convince a user that the inserted text is legitimate.
In the OpenShift web console in versions 3.11 and 4.x an attacker can craft a URL in which to inject arbitrary text into error pages. This could be used to convince a user that the injected text is legitimate.
References:
https://www.owasp.org/index.php/ContentSpoofing
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-10715?
CVE-2020-10715 is classified as a medium severity vulnerability, primarily due to its content spoofing nature.
How do I fix CVE-2020-10715?
To resolve CVE-2020-10715, ensure you update to the patched versions of the affected OpenShift web console components.
What types of software are affected by CVE-2020-10715?
CVE-2020-10715 affects OpenShift versions 3.11 and 4.x, specifically the atomic-openshift-web-console and openshift/origin-web-console packages.
What is the impact of exploiting CVE-2020-10715?
Exploitation of CVE-2020-10715 allows attackers to inject misleading content into error pages, potentially deceiving users.
Is CVE-2020-10715 a common vulnerability found in OpenShift?
CVE-2020-10715 is a specific content spoofing vulnerability identified in certain versions of OpenShift, making it a unique issue rather than a common one.