What’s Vulnerable › Vulnerabilities
CVE-2024-6508: Openshift-console: oauth2 insufficient state parameter entropy
- Severity: high (CVSS 8.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-08-21 · updated 2026-08-11
- Weakness: CWE-331
Description
An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions.
Affected products
- Red Hat OpenShift Container Platform 4.18: all versions — fixed in 418.94.202502100215-0, v4.18.0-202412170221.p0.ga26fffe.assembly.stream.el9, v4.18.0-202412170221.p0.gcfbae04.assembly.stream.el9, v4.18.0-202412200107.p0.g2957f13.assembly.stream.el9, v4.18.0-202501201133.p0.g4674e81.assembly.stream.el9, v4.18.0-202501230001.p0.g00882ba.assembly.stream.el9
- Red Hat OpenShift Container Platform 4.12: all versions — fixed in v4.12.0-202412201659.p0.g8910d84.assembly.stream.el8
- Red Hat OpenShift Container Platform 4.13: all versions — fixed in v4.13.0-202411300029.p0.g68accd9.assembly.stream.el8
- Red Hat OpenShift Container Platform 4.14: all versions — fixed in v4.14.0-202411131205.p0.g839a801.assembly.stream.el8
- Red Hat OpenShift Container Platform 4.15: all versions — fixed in v4.15.0-202411060036.p0.gd8360d4.assembly.stream.el8
- Red Hat OpenShift Container Platform 4.16: all versions — fixed in v4.16.0-202410231737.p0.gf0870c3.assembly.stream.el9
- Red Hat OpenShift Container Platform 4.17: all versions — fixed in v4.17.0-202410091535.p0.ge61f187.assembly.stream.el9
How to fix
Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.18 418.94.202502100215-0, v4.18.0-202412170221.p0.ga26fffe.assembly.stream.el9, v4.18.0-202412170221.p0.gcfbae04.assembly.stream.el9, v4.18.0-202412200107.p0.g2957f13.assembly.stream.el9; Red Hat OpenShift Container Platform 4.12 v4.12.0-202412201659.p0.g8910d84.assembly.stream.el8; Red Hat OpenShift Container Platform 4.13 v4.13.0-202411300029.p0.g68accd9.assembly.stream.el8; Red Hat OpenShift Container Platform 4.14 v4.14.0-202411131205.p0.g839a801.assembly.stream.el8; Red Hat OpenShift Container Platform 4.15 v4.15.0-202411060036.p0.gd8360d4.assembly.stream.el8; Red Hat OpenShift Container Platform 4.16 v4.16.0-202410231737.p0.gf0870c3.assembly.stream.el9; Red Hat OpenShift Container Platform 4.17 v4.17.0-202410091535.p0.ge61f187.assembly.stream.el9. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2024:10813
- https://access.redhat.com/errata/RHSA-2024:6122
- https://access.redhat.com/errata/RHSA-2024:7922
- https://access.redhat.com/errata/RHSA-2024:8415
- https://access.redhat.com/errata/RHSA-2024:8991
- https://access.redhat.com/errata/RHSA-2024:9620
- https://access.redhat.com/errata/RHSA-2025:0014
- https://access.redhat.com/security/cve/CVE-2024-6508
- https://bugzilla.redhat.com/show_bug.cgi?id=2295777
Get alerted when CVE-2024-6508 or the next vulnerability affects your stack