CVE-2019-10176

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain static during a user's session. An attacker with the ability to observe the value of this token would be able to re-use the token to perform a CSRF attack.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
RedHatatomic-openshiftall versions fixed

References

Timeline

Published
Aug 2, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-101776.5A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user inCVE-2019-101786.1It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored CroCVE-2019-101796.1A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize reCVE-2019-10187.0An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited thiCVE-2019-101804.8A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parametCVE-2019-101818.1It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising thCVE-2019-101826.5It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could tCVE-2019-101833.3Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interactioCVE-2019-101847.5undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted throCVE-2019-101858.6It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. CVE-2019-101868.8A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading aCVE-2019-101874.3A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete
CVE-2019-10176: Medium severity, CVSS 5.4 | Vulnix