CVE-2024-6508

HighCVSS 8.0/10Last modified Aug 11, 2026

Description

An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-331

Affected software

No affected versions have been published.

Timeline

Published
Aug 21, 2024
Last modified
Aug 11, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-65096.5Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which couCVE-2024-65107.8Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COMCVE-2024-65116.1A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonReqCVE-2024-65126.5Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users witCVE-2024-65158.1Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintCVE-2024-65166.1Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser.  AffectedCVE-2024-65176.1The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the pagCVE-2024-65184.4The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored CrossCVE-2024-65198.2A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escapeCVE-2024-65204.4The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored CrossCVE-2024-65214.4The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored CrossCVE-2024-65229.6The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 vi