CVE-2024-6508
Openshift-console: oauth2 insufficient state parameter entropy
HIGH 8.0
At a glance
- Source
- NVD
- EPSS
- EPSS 0.67 % · percentile 52 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Deferred
Description
An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions.
Weaknesses (CWE)
- CWE-331 — Insufficient Entropy
References
- https://access.redhat.com/errata/RHSA-2024:10813
- https://access.redhat.com/errata/RHSA-2024:6122
- https://access.redhat.com/errata/RHSA-2024:7922
- https://access.redhat.com/errata/RHSA-2024:8415
- https://access.redhat.com/errata/RHSA-2024:8991
- https://access.redhat.com/errata/RHSA-2024:9620
- https://access.redhat.com/errata/RHSA-2025:0014
- https://access.redhat.com/security/cve/CVE-2024-6508
- https://bugzilla.redhat.com/show_bug.cgi?id=2295777
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H | redhat |
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
Advisories
- GHSA-4crf-28c7-v4gr — Openshift Console insufficient entropy vulnerability
- GO-2024-3083 — Openshift Console insufficient entropy vulnerability in github.com/openshift/console
European references
- ENISA EUVD · EUVD-2024-2489
- GCVE · GCVE-0-2024-6508
Affected products
| Product | Versions |
|---|---|
| openshift-console | |
| Red Hat · Red Hat OpenShift Container Platform 4.12 | unaffected v4.12.0-202412201659.p0.g8910d84.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.13 | unaffected v4.13.0-202411300029.p0.g68accd9.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202411131205.p0.g839a801.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.15 | unaffected v4.15.0-202411060036.p0.gd8360d4.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.16 | unaffected v4.16.0-202410231737.p0.gf0870c3.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.17 | unaffected v4.17.0-202410091535.p0.ge61f187.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.g088dcaf.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.gd4fb1b6.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.g11ced00.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.gf648c78.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.g24a6532.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202502100301.p0.g2e139ed.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.g3193a75.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202502041302.p0.g1ad8f2e.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.g7149f2d.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.g7149f2d.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.g962ccca.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.gba2234b.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202502111035.p0.gf76635f.assembly.stream.el9 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |