Bug 1750928 (CVE-2019-14836) - CVE-2019-14836 3scale: dev portal missing protection against login CSRF
Summary: CVE-2019-14836 3scale: dev portal missing protection against login CSRF
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-14836
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1750562 1942917
TreeView+ depends on / blocked
 
Reported: 2019-09-10 19:04 UTC by Chess Hazlett
Modified: 2021-10-27 10:48 UTC (History)
9 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2021-10-27 10:48:44 UTC
Embargoed:

Attachments (Terms of Use)

Description Chess Hazlett 2019-09-10 19:04:43 UTC 
3scale dev portal login form does not verify CSRF token, and so does not protect against login CSRF.
Comment 3 hramihaj 2021-05-25 16:36:25 UTC 
We tried to verify that with a crafted Cross Site page (as in CSRF). We can't reproduce the issue. Can you provide a full procedure on to reproduce the issue?

Thank you.

The result is:

Access Denied
Sorry, you do not have permission to access this page.
Note You need to log in before you can comment on or make changes to this bug.