CVE-2020-10715 Cross-site scripting in openshift/console
Attackers can inject arbitrary text into OpenShift Console error pages via crafted URLs, potentially deceiving users into believing the content is legitimate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-10715?
CVE-2020-10715 is a medium-severity cross-site scripting vulnerability in Redhat Openshift, published on 16 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. This flaw allows an attacker to craft a URL and inject arbitrary text onto the error page that appears to be from the OpenShift instance. This attack could potentially convince a user that the inserted text is legitimate.
Weakness: CWE-20
Which versions are affected by CVE-2020-10715?
It affects 1 product.
Products include Redhat Openshift.
How do I fix CVE-2020-10715?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-10715 being exploited?
There is no known exploitation of CVE-2020-10715 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openshift
Sources
Also known as GHSA-7p43-3rw5-j59j.