CVE-2020-1761

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-27 · updated 2026-06-17
Weakness: CWE-358

Description

A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. An attacker can use this flaw to get the access token via physical access, or an XSS attack on the victim's browser. This flaw affects openshift/console versions before openshift/console-4.

Affected products

Openshift: before 4.0 — fixed in 4.0

How to fix

Upgrade to a fixed version: Openshift 4.0. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1813788
https://bugzilla.redhat.com/show_bug.cgi?id=1813788

Get alerted when CVE-2020-1761 or the next vulnerability affects your stack