XSS in Red Hat Openshift Container Platform
CVE-2018-10937
A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker with the ability to create pods can use this flaw to perform actions on the K8s API as the victim.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.011 (61.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L.
Affected products
- Red Hat Openshift Container Platform — versions 3.11
- Redhat Openshift_container_platform — versions 3.11
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-10937?
- CVE-2018-10937 is a medium-severity vulnerability in Red Hat Openshift Container Platform, classified under Cross-site Scripting. CVSS score: 4.6/10. Published 2018-09-11.
- How severe is CVE-2018-10937?
- Medium severity. CVSS v3 base score is 4.6 out of 10.