CVE-2024-1342

openshift: existing Cross-Site Request Forgery protection insufficient for WebSocket creation

View on CVE.org
Published Feb 16, 2024 CVSS 3.1 · 4.2 Medium EPSS n/a KEV · Not listed
Description
Unable to reproduce.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Openshift: existing cross-site request forgery protection insufficient for websocket creation openshift: existing Cross-Site Request Forgery protection insufficient for WebSocket creation
References
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

 cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'}
Type Values Removed Values Added
Description A flaw was found in OpenShift. The existing Cross-Site Request Forgery (CSRF) protections in place do not properly protect GET requests, allowing for the creation of WebSockets via CSRF. Unable to reproduce.
CPEs cpe:/a:redhat:openshift:4
Vendors & Products Redhat
Redhat openshift

Subscriptions

No data.

Weaknesses

Sources

Status
REJECTED
Assigner
redhat
Published
Updated
Oct 14, 2024, 10:00 PM
Reserved
Feb 7, 2024, 10:26 PM

View source JSON

Updated

JSON

Status
Rejected
Published
Feb 16, 2024, 4:15 PM
Modified
Oct 14, 2024, 10:15 PM

View source JSON

Severity
Moderate
Public date
Feb 13, 2024, 12:00 AM

View source Bugzilla JSON

No data.