CVE-2018-10937: red hat openshift container platform Cross-site Scripting
CVSS: 5.4v3.0MediumModified
Published 11-09-2018Last modified 05-08-2024
Vulnerability summary
CVE-2018-10937 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in red hat openshift container platform. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 64.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.4/10
010
Medium · v3.0 (NVD)EPSS score
1.08%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Timeline
- 11-09-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker with the ability to create pods can use this flaw to perform actions on the K8s API as the victim.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 5.4Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NSources2 sources · 4.6–5.4
- CVE.orgCNA4.6MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:LDiffers
Low 3.5Preferred score · NVD (NIST)
AV:N/AC:M/Au:S/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
1.08%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
0.00 pp
From 1.08% on 19-09-2026
19-09-202619-10-2026
EPSS score1.08%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundConsole
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Red hat1 product
Redhat1 product
2 vendors · 2 products
References
4 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10937X Refsource CONFIRMIssue TrackingThird Party Advisory
- github.com/openshift/console/commit/d56666852da6e7309a2e63a49f49a72ff66d309cX Refsource CONFIRMExploitThird Party Advisory