« Volver al listado

CVE-2017-7534

Estado: ModificadaMedia (5.4)—

Las versiones 3.x de OpenShift Enterprise son vulnerables a Cross-Site Scripting (XSS) persistente mediante el visor de logs para pods. El error se debe a la falta de saneamiento de entradas de usuario, específicamente los caracteres de escape de terminal, y la creación de enlaces sobre los que se puede hacer clic automáticamente al ver los archivos log para un pod.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Redhat — Openshift

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-7534",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "Red Hat, Inc.",
          "product": "Openshift",
          "versions": [
            {
              "status": "affected",
              "version": "3.x"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-04-11T19:29:00.213",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/103754",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443003",
      "tags": [
        "Issue Tracking"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/103754",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443003",
      "tags": [
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user input, specifically terminal escape characters, and the creation of clickable links automatically when viewing the log files for a pod."
    },
    {
      "lang": "es",
      "value": "Las versiones 3.x de OpenShift Enterprise son vulnerables a Cross-Site Scripting (XSS) persistente mediante el visor de logs para pods. El error se debe a la falta de saneamiento de entradas de usuario, específicamente los caracteres de escape de terminal, y la creación de enlaces sobre los que se puede hacer clic automáticamente al ver los archivos log para un pod."
    }
  ],
  "lastModified": "2026-06-17T01:24:33.180",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:openshift:3.0:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45690263-84D9-45A1-8C30-3ED2F0F11F47"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openshift:3.1:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8E35FAB-695F-44DA-945D-60B47C1F200B"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openshift:3.2:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F33CEF04-05FA-444C-BB14-F3E3434AF61F"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openshift:3.3:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84C890EC-229B-458B-AEF7-EA03C6248A25"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openshift:3.4:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1056A33-690E-4120-821F-52B9705CB84B"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openshift:3.5:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FB4CEB9-3106-41D7-BBAA-FA92D2698FA4"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openshift:3.6:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B196A82-385B-492A-8927-723CB8690CCC"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openshift:3.7:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D9724B7-D99B-4376-B1B5-5CE5F336D767"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openshift:3.9:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8F8362B-DA49-439F-ADA1-B5BA443F91F7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}