CVEvulnerability
CVE-2018-10937
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-09-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 4.6 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
- CVSS 3.0 ([email protected])
- 5.4 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker with the ability to create pods can use this flaw to perform actions on the K8s API as the victim.
Affected configurations
• redhat openshift container platform 3.11
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.securityfocus.com/bid/105190 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10937 Issue Tracking, Third Party Advisory
- https://github.com/openshift/console/commit/d56666852da6e7309a2e63a49f49a72ff66d309c Exploit, Third Party Advisory
- https://github.com/openshift/console/pull/461 Third Party Advisory
- http://www.securityfocus.com/bid/105190 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10937 Issue Tracking, Third Party Advisory
- https://github.com/openshift/console/commit/d56666852da6e7309a2e63a49f49a72ff66d309c Exploit, Third Party Advisory
- https://github.com/openshift/console/pull/461 Third Party Advisory