CVE-2024-6508

ADVISORY - github

Summary

An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions.

EPSS Score⁠: 0.00673 (0.498)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-331⁠

Insufficient Entropy

ADVISORY - github

CWE-331⁠

Insufficient Entropy

ADVISORY - gitlab

CWE-1035⁠

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

CWE-331⁠

Insufficient Entropy

CWE-937⁠

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

ADVISORY - redhat

CWE-331⁠

Insufficient Entropy

Impacted images

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.