CVE-2019-3889
A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform...
A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 and openshift-enterprise-3.9 through 3.11. An attacker could use this flaw to steal authorization data by getting them to click on a malicious link.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 and openshift-enterprise-3.9 through 3.11. An attacker could use this flaw to steal authorization data by getting them to click on a malicious link.
- Record
CVE-2019-3889- CVSS 3.0
- 4.6 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2019-13498
A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 and openshift-enterprise-3.9 through 3.11. An attacker could use this flaw to steal authorization data by getting them to click on a malicious link.
- Record
EUVD-2019-13498- CVSS 3.0
- 4.6 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mgc5-697q-9jc6
A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform...
A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 and openshift-enterprise-3.9 through 3.11. An attacker could use this flaw to steal authorization data by getting them to click on a malicious link.
- Record
GHSA-mgc5-697q-9jc6- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 and openshift-enterprise-3.9 through 3.11. An attacker could use this flaw to steal authorization data by getting them to click on a malicious link.
- Record
CVE-2019-3889- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 4.6 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVRHSA-2020:0795
Red Hat Security Advisory: OpenShift Container Platform 3.11 security update
- Record
RHSA-2020:0795- CVSS 3.0
- 4.6 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
atomic-openshiftRed Hat:openshift:3.11::el7 |
before 0:3.11.188-1.git.0.db0eaa8.el7 | 0:3.11.188-1.git.0.db0eaa8.el7 |
atomic-openshift-clientsRed Hat:openshift:3.11::el7 |
before 0:3.11.188-1.git.0.db0eaa8.el7 | 0:3.11.188-1.git.0.db0eaa8.el7 |
atomic-openshift-clients-redistributableRed Hat:openshift:3.11::el7 |
before 0:3.11.188-1.git.0.db0eaa8.el7 | 0:3.11.188-1.git.0.db0eaa8.el7 |
atomic-openshift-docker-excluderRed Hat:openshift:3.11::el7 |
before 0:3.11.188-1.git.0.db0eaa8.el7 | 0:3.11.188-1.git.0.db0eaa8.el7 |
atomic-openshift-excluderRed Hat:openshift:3.11::el7 |
before 0:3.11.188-1.git.0.db0eaa8.el7 | 0:3.11.188-1.git.0.db0eaa8.el7 |
atomic-openshift-hyperkubeRed Hat:openshift:3.11::el7 |
before 0:3.11.188-1.git.0.db0eaa8.el7 | 0:3.11.188-1.git.0.db0eaa8.el7 |
atomic-openshift-hypershiftRed Hat:openshift:3.11::el7 |
before 0:3.11.188-1.git.0.db0eaa8.el7 | 0:3.11.188-1.git.0.db0eaa8.el7 |
atomic-openshift-masterRed Hat:openshift:3.11::el7 |
before 0:3.11.188-1.git.0.db0eaa8.el7 | 0:3.11.188-1.git.0.db0eaa8.el7 |
atomic-openshift-nodeRed Hat:openshift:3.11::el7 |
before 0:3.11.188-1.git.0.db0eaa8.el7 | 0:3.11.188-1.git.0.db0eaa8.el7 |
atomic-openshift-podRed Hat:openshift:3.11::el7 |
before 0:3.11.188-1.git.0.db0eaa8.el7 | 0:3.11.188-1.git.0.db0eaa8.el7 |
atomic-openshift-sdn-ovsRed Hat:openshift:3.11::el7 |
before 0:3.11.188-1.git.0.db0eaa8.el7 | 0:3.11.188-1.git.0.db0eaa8.el7 |
atomic-openshift-template-service-brokerRed Hat:openshift:3.11::el7 |
before 0:3.11.188-1.git.0.db0eaa8.el7 | 0:3.11.188-1.git.0.db0eaa8.el7 |
atomic-openshift-testsRed Hat:openshift:3.11::el7 |
before 0:3.11.188-1.git.0.db0eaa8.el7 | 0:3.11.188-1.git.0.db0eaa8.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-3889 is a medium vulnerability (CVSS 4.6) in Redhat Openshift Container Platform, published July 11, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in atomic-openshift 0:3.11.188-1.git.0.db0eaa8.el7.