Description

A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. An attacker can use this flaw to get the access token via physical access, or an XSS attack on the victim's browser. This flaw affects openshift/console versions before openshift/console-4.

Related CPE's

a

redhat

openshift

Vulnerable

References

https://bugzilla.redhat.com/show_bug.cgi?id=1813788

Issue TrackingVendor Advisory

Weaknesses

[email protected]

Primary
NVD-CWE-Other

[email protected]

Secondary
CWE-358

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 · Medium

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2021-05-27T20:15:08.030

4 years ago

Last modified

2022-08-05T15:37:17.517

2 years ago