Bug 901364 (CVE-2013-0196) - CVE-2013-0196 OpenShift Enterprise and Online vulnerable to CSRF attack with REST API
Summary: CVE-2013-0196 OpenShift Enterprise and Online vulnerable to CSRF attack with ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2013-0196
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 893369 894248
Blocks: 872346 901372
TreeView+ depends on / blocked
 
Reported: 2013-01-18 04:10 UTC by Kurt Seifried
Modified: 2023-05-12 12:29 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-09-06 05:44:41 UTC
Embargoed:

Attachments (Terms of Use)

Description Kurt Seifried 2013-01-18 04:10:27 UTC 
Jeremy Choi (jechoi) of Red Hat reports:

Description of problem:

Since the web console is using 'Basic authentication' and the REST API has no 
CSRF attack protection mechanism, the credential, the Authorization: header, 
can be sent when requesting the REST API via web browser. As a result, while 
users are authenticated malicious links or scripts provided by attackers can 
cause unwanted action.
Comment 1 Murray McAllister 2013-04-04 05:43:03 UTC 
Acknowledgements:

This issue was discovered by Jeremy Choi of the Red Hat Hosted and Shared
Services team.
Comment 2 Kurt Seifried 2014-09-06 05:44:41 UTC 
This issue was addressed in http://rhn.redhat.com/errata/RHEA-2013-1031.html
Note You need to log in before you can comment on or make changes to this bug.