Bug 1930083 (CVE-2021-3442)

Summary:	CVE-2021-3442 PT RHOAM: XSS in 3scale at various places
Product:	[Other] Security Response	Reporter:	lnacshon
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amackenz, amasferr, chazlett, drieden, mkudlej, oasaf, security-response-team, tjochec
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Red Hat OpenShift API Management product. User input is not validated allowing an authenticated user to inject scripts into some text boxes leading to a XSS attack. The highest threat from this vulnerability is to data confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-14 08:08:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1928242, 1939022

Description lnacshon 2021-02-18 10:49:22 UTC

During the test we found that there are no input validation for user input, and its possible to inject scripts into text box in the following links 

https://3scale-admin.apps.rhoam-pentest.ofop.p1.openshiftapps.com/site/emails/edit
https://3scale-admin.apps.rhoam-pentest.ofop.p1.openshiftapps.com/p/admin/backend_apis/2
The XSS attack is possible only by an authenticated user so the severity is low

Comment 7 lnacshon 2021-03-15 09:56:41 UTC

Acknowledgments:

Name: Siddharth Sharma (Red Hat Product Security), Or Asaf (Red Hat Product Security)

Comment 8 lnacshon 2021-07-07 11:58:13 UTC

Affected version 2.9.1 GA

Comment 10 Chess Hazlett 2021-07-22 20:33:26 UTC

*** Bug 1850967 has been marked as a duplicate of this bug. ***

Comment 11 errata-xmlrpc 2021-10-14 07:55:17 UTC

This issue has been addressed in the following products:

  3scale API Management

Via RHSA-2021:3851 https://access.redhat.com/errata/RHSA-2021:3851

Comment 12 Product Security DevOps Team 2021-10-14 08:08:33 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3442