CVE-2013-0196: openshift openshift enterprise Cross-Site Request Forgery (CSRF)

CVSS: 6.5v3.1MediumModified

AliasesRHEA-2013:1031

Published 30-12-2019Last modified 06-08-2024

Vulnerability summary

CVE-2013-0196 is a medium (CVSS 6.5) Cross-Site Request Forgery (CSRF) vulnerability in openshift openshift enterprise. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

36/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (NVD)

EPSS score

0.43%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Timeline

30-12-2019
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser.

CVSS metrics

2 scores · 1 source · 2 versions

v3.16.5v2.04.3

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

36%

Versus all other CVEs

30-day change

0.00 pp

From 0.43% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Affected systems

Redhat181 products

openshift1.2
activemq< 0:5.6.0-5.el6op
activemq-client< 0:5.6.0-5.el6op
libev< 0:4.04-4.el6op
libev-debuginfo< 0:4.04-4.el6op

libev-devel< 0:4.04-4.el6op
libmongodb< 0:2.2.3-2.el6op
mcollective< 0:2.2.1-4.el6op
mcollective-client< 0:2.2.1-4.el6op
mongodb< 0:2.2.3-2.el6op
mongodb-debuginfo< 0:2.2.3-2.el6op
mongodb-devel< 0:2.2.3-2.el6op
mongodb-server< 0:2.2.3-2.el6op
numpy< 0:1.4.1-9.el6
numpy-debuginfo< 0:1.4.1-9.el6
numpy-f2py< 0:1.4.1-9.el6
openshift-enterprise-release< 0:1.2.0-1.el6op
openshift-enterprise-upgrade< 0:1.2.0-1.el6op
openshift-enterprise-upgrade-broker< 0:1.2.0-1.el6op
openshift-enterprise-upgrade-node< 0:1.2.0-1.el6op
openshift-origin-broker< 0:1.5.2-1.1.el6op
openshift-origin-broker-util< 0:1.9.7-1.2.el6op
openshift-origin-console< 0:1.5.19-1.el6op
openshift-origin-msg-common< 0:1.7.2-1.1.el6op
openshift-origin-util-scl< 0:1.4.1-1.1.el6op
ruby193< 0:1-8.el6
ruby193-libyaml< 0:0.1.4-4.el6
ruby193-libyaml-debuginfo< 0:0.1.4-4.el6
ruby193-libyaml-devel< 0:0.1.4-4.el6
ruby193-mcollective-common< 0:2.2.1-4.el6op
ruby193-mod_passenger< 0:3.0.17-11.el6op
ruby193-ruby< 0:1.9.3.429-34.el6
ruby193-ruby-debuginfo< 0:1.9.3.429-34.el6
ruby193-ruby-devel< 0:1.9.3.429-34.el6
ruby193-ruby-doc< 0:1.9.3.429-34.el6
ruby193-ruby-irb< 0:1.9.3.429-34.el6
ruby193-ruby-libs< 0:1.9.3.429-34.el6
ruby193-ruby-tcltk< 0:1.9.3.429-34.el6
ruby193-rubygem-actionmailer< 1:3.2.8-1.el6
ruby193-rubygem-actionmailer-doc< 1:3.2.8-1.el6
ruby193-rubygem-actionpack< 1:3.2.8-5.el6
ruby193-rubygem-actionpack-doc< 1:3.2.8-5.el6
ruby193-rubygem-activemodel< 0:3.2.8-2.el6
ruby193-rubygem-activemodel-doc< 0:3.2.8-2.el6
ruby193-rubygem-activerecord< 1:3.2.8-6.el6
ruby193-rubygem-activerecord-doc< 1:3.2.8-6.el6
ruby193-rubygem-activeresource< 1:3.2.8-1.el6
ruby193-rubygem-activeresource-doc< 1:3.2.8-1.el6
ruby193-rubygem-activesupport< 1:3.2.8-4.el6
ruby193-rubygem-arel< 0:3.0.2-3.el6
ruby193-rubygem-arel-doc< 0:3.0.2-3.el6
ruby193-rubygem-bigdecimal< 0:1.1.0-34.el6
ruby193-rubygem-bson< 0:1.8.1-1.el6op
ruby193-rubygem-bson_ext< 0:1.8.1-2.el6op
ruby193-rubygem-bson_ext-debuginfo< 0:1.8.1-2.el6op
ruby193-rubygem-builder< 0:3.0.0-2.el6
ruby193-rubygem-builder-doc< 0:3.0.0-2.el6
ruby193-rubygem-bundler< 0:1.1.4-3.el6
ruby193-rubygem-bundler-doc< 0:1.1.4-3.el6
ruby193-rubygem-chunky_png< 0:1.2.6-3.el6op
ruby193-rubygem-coffee-rails< 0:3.2.2-2.el6
ruby193-rubygem-coffee-rails-doc< 0:3.2.2-2.el6
ruby193-rubygem-coffee-script< 0:2.2.0-2.el6
ruby193-rubygem-coffee-script-doc< 0:2.2.0-2.el6
ruby193-rubygem-coffee-script-source< 0:1.3.3-3.el6
ruby193-rubygem-coffee-script-source-doc< 0:1.3.3-3.el6
ruby193-rubygem-compass< 0:0.12.2-4.el6op
ruby193-rubygem-compass-rails< 0:1.0.3-2.el6op
ruby193-rubygem-compass-rails-doc< 0:1.0.3-2.el6op
ruby193-rubygem-diff-lcs< 0:1.1.3-1.el6
ruby193-rubygem-diff-lcs-doc< 0:1.1.3-1.el6
ruby193-rubygem-dnsruby< 0:1.53-3.el6op
ruby193-rubygem-erubis< 0:2.7.0-4.el6
ruby193-rubygem-erubis-doc< 0:2.7.0-4.el6
ruby193-rubygem-execjs< 0:1.4.0-4.el6
ruby193-rubygem-execjs-doc< 0:1.4.0-4.el6
ruby193-rubygem-file-tail< 0:1.0.5-5.el6op
ruby193-rubygem-file-tail-doc< 0:1.0.5-5.el6op
ruby193-rubygem-formtastic< 0:1.2.4-2.el6op
ruby193-rubygem-formtastic-doc< 0:1.2.4-2.el6op
ruby193-rubygem-fssm< 0:0.2.8.1-2.el6op
ruby193-rubygem-fssm-doc< 0:0.2.8.1-2.el6op
ruby193-rubygem-haml< 0:3.1.7-3.el6op
ruby193-rubygem-hike< 0:1.2.1-3.el6
ruby193-rubygem-hike-doc< 0:1.2.1-3.el6
ruby193-rubygem-i18n< 0:0.6.0-3.el6
ruby193-rubygem-i18n-doc< 0:0.6.0-3.el6
ruby193-rubygem-io-console< 0:0.3-34.el6
ruby193-rubygem-journey< 0:1.0.4-1.el6
ruby193-rubygem-journey-doc< 0:1.0.4-1.el6
ruby193-rubygem-jquery-rails< 0:2.0.2-2.el6
ruby193-rubygem-jquery-rails-doc< 0:2.0.2-2.el6
ruby193-rubygem-json< 0:1.5.5-34.el6
ruby193-rubygem-mail< 0:2.4.4-3.el6
ruby193-rubygem-mail-doc< 0:2.4.4-3.el6
ruby193-rubygem-mime-types< 0:1.19-1.el6
ruby193-rubygem-mime-types-doc< 0:1.19-1.el6
ruby193-rubygem-minitest< 0:3.5.0-3.el6op
ruby193-rubygem-mongo< 0:1.8.1-1.el6op
ruby193-rubygem-mongo-doc< 0:1.8.1-1.el6op
ruby193-rubygem-mongoid< 0:3.0.21-1.el6op
ruby193-rubygem-moped< 0:1.3.2-1.el6op
ruby193-rubygem-multi_json< 0:1.3.6-1.el6
ruby193-rubygem-multi_json-doc< 0:1.3.6-1.el6
ruby193-rubygem-net-http-persistent< 0:2.7-2.el6
ruby193-rubygem-net-http-persistent-doc< 0:2.7-2.el6
ruby193-rubygem-open4< 0:1.3.0-3.el6op
ruby193-rubygem-open4-doc< 0:1.3.0-3.el6op
ruby193-rubygem-origin< 0:1.0.7-2.el6op
ruby193-rubygem-parseconfig< 0:1.0.2-1.el6op
ruby193-rubygem-passenger< 0:3.0.17-11.el6op
ruby193-rubygem-passenger-debuginfo< 0:3.0.17-11.el6op
ruby193-rubygem-passenger-devel< 0:3.0.17-11.el6op
ruby193-rubygem-passenger-doc< 0:3.0.17-11.el6op
ruby193-rubygem-passenger-native< 0:3.0.17-11.el6op
ruby193-rubygem-passenger-native-libs< 0:3.0.17-11.el6op
ruby193-rubygem-polyglot< 0:0.3.3-2.el6
ruby193-rubygem-polyglot-doc< 0:0.3.3-2.el6
ruby193-rubygem-rack< 1:1.4.1-5.el6
ruby193-rubygem-rack-cache< 0:1.2-2.el6
ruby193-rubygem-rack-cache-doc< 0:1.2-2.el6
ruby193-rubygem-rack-protection< 0:1.2.0-7.el6
ruby193-rubygem-rack-protection-doc< 0:1.2.0-7.el6
ruby193-rubygem-rack-ssl< 0:1.3.2-7.el6
ruby193-rubygem-rack-ssl-doc< 0:1.3.2-7.el6
ruby193-rubygem-rack-test< 0:0.6.1-3.el6
ruby193-rubygem-rails< 1:3.2.8-2.el6
ruby193-rubygem-railties< 0:3.2.8-2.el6
ruby193-rubygem-railties-doc< 0:3.2.8-2.el6
ruby193-rubygem-rake< 0:0.9.2.2-34.el6
ruby193-rubygem-rdiscount< 0:1.6.8-3.el6op
ruby193-rubygem-rdiscount-debuginfo< 0:1.6.8-3.el6op
ruby193-rubygem-rdiscount-doc< 0:1.6.8-3.el6op
ruby193-rubygem-rdoc< 0:3.9.5-34.el6
ruby193-rubygem-ref< 0:1.0.0-3.el6
ruby193-rubygem-ref-doc< 0:1.0.0-3.el6
ruby193-rubygem-regin< 0:0.3.7-4.el6op
ruby193-rubygem-rest-client< 0:1.6.1-2.el6op
ruby193-rubygem-safe_yaml< 0:0.9.1-1.el6op
ruby193-rubygem-sass< 0:3.1.20-2.el6
ruby193-rubygem-sass-doc< 0:3.1.20-2.el6
ruby193-rubygem-sass-rails< 0:3.2.5-2.el6
ruby193-rubygem-sass-rails-doc< 0:3.2.5-2.el6
ruby193-rubygem-sexp_processor< 0:3.2.0-2.el6op
ruby193-rubygem-sexp_processor-doc< 0:3.2.0-2.el6op
ruby193-rubygem-sprockets< 0:2.4.5-2.el6
ruby193-rubygem-sprockets-doc< 0:2.4.5-2.el6
ruby193-rubygem-spruz< 0:0.2.5-5.el6op
ruby193-rubygem-spruz-doc< 0:0.2.5-5.el6op
ruby193-rubygem-state_machine< 0:1.1.2-7.el6op
ruby193-rubygem-stomp< 0:1.1.8-1.el6op
ruby193-rubygem-systemu< 0:2.5.2-2.el6op
ruby193-rubygem-therubyracer< 0:0.11.0-0.5.beta5.el6
ruby193-rubygem-therubyracer-debuginfo< 0:0.11.0-0.5.beta5.el6
ruby193-rubygem-therubyracer-doc< 0:0.11.0-0.5.beta5.el6
ruby193-rubygem-thor< 0:0.15.4-1.el6
ruby193-rubygem-thor-doc< 0:0.15.4-1.el6
ruby193-rubygem-tilt< 0:1.3.3-8.el6
ruby193-rubygem-tilt-doc< 0:1.3.3-8.el6
ruby193-rubygem-treetop< 0:1.4.10-6.el6
ruby193-rubygem-tzinfo< 0:0.3.33-2.el6
ruby193-rubygem-tzinfo-doc< 0:0.3.33-2.el6
ruby193-rubygem-uglifier< 0:1.2.6-2.el6
ruby193-rubygem-uglifier-doc< 0:1.2.6-2.el6
ruby193-rubygem-xml-simple< 0:1.0.12-10.el6op
ruby193-rubygems< 0:1.8.23-34.el6
ruby193-rubygems-devel< 0:1.8.23-34.el6
ruby193-runtime< 0:1-8.el6
ruby193-v8< 1:3.14.5.8-3.el6
ruby193-v8-debuginfo< 1:3.14.5.8-3.el6
ruby193-v8-devel< 1:3.14.5.8-3.el6
rubygem-openshift-origin-auth-remote-user< 0:1.8.1-1.1.el6op
rubygem-openshift-origin-common< 0:1.8.11-1.el6op
rubygem-openshift-origin-console< 0:1.9.14-1.el6op
rubygem-openshift-origin-console-doc< 0:1.9.14-1.el6op
rubygem-openshift-origin-controller< 0:1.9.14-1.2.el6op
rubygem-openshift-origin-dns-nsupdate< 0:1.5.2-1.1.el6op
rubygem-openshift-origin-msg-broker-mcollective< 0:1.9.9-1.1.el6op
rubygems< 0:1.8.16-2.el6op
yum-plugin-priorities< 0:1.1.30-14.el6
yum-utils< 0:1.1.30-14.el6

Show all 181

Openshift1 product

openshift enterprise1.2

2 vendors · 182 products

References

15 links

bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0196X Refsource MISCExploitIssue TrackingThird Party Advisory
access.redhat.com/security/cve/cve-2013-0196X Refsource MISCThird Party Advisory
access.redhat.com/errata/RHEA-2013:1031Advisory
bugzilla.redhat.com/show_bug.cgi?id=878205REPORT
bugzilla.redhat.com/show_bug.cgi?id=895864REPORT
bugzilla.redhat.com/show_bug.cgi?id=913390REPORT
bugzilla.redhat.com/show_bug.cgi?id=917493REPORT
bugzilla.redhat.com/show_bug.cgi?id=924103REPORT
bugzilla.redhat.com/show_bug.cgi?id=958437REPORT
bugzilla.redhat.com/show_bug.cgi?id=970805REPORT

Show all 15 references

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities