Every CVE Search/ Get API key

CVE-2016-3703

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when...

5.3 MediumFix available

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.18%Up 0.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.3

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.

Record
CVE-2016-3703
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:P/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02
CVE List No score

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.

Record
CVE-2016-3703
Updated
2026-11-02
EUVDEUVD-2016-4724 No score

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.

Record
EUVD-2016-4724
Updated
2026-11-03
GitHub AdvisoriesGHSA-xhrq-h87x-w62q 5.3

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when...

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.

Record
GHSA-xhrq-h87x-w62q
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
atomic-openshift
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
 before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-clients
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
 before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-clients-redistributable
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
 before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-dockerregistry
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
 before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-master
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
 before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-node
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
 before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-pod
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
 before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-recycle
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
 before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-sdn-ovs
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
 before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-tests
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
 before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
Show 12 moreShow less
Affected packages
PackageAffectedFixed
nodejs-node-uuid
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
 before 0:1.4.7-1.el7
0:1.4.7-1.el7
tuned-profiles-atomic-openshift-node
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
 before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift
Red Hat:openshift:3.1::el7
 before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-clients
Red Hat:openshift:3.1::el7
 before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-clients-redistributable
Red Hat:openshift:3.1::el7
 before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-dockerregistry
Red Hat:openshift:3.1::el7
 before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-master
Red Hat:openshift:3.1::el7
 before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-node
Red Hat:openshift:3.1::el7
 before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-pod
Red Hat:openshift:3.1::el7
 before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-recycle
Red Hat:openshift:3.1::el7
 before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-sdn-ovs
Red Hat:openshift:3.1::el7
 before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
tuned-profiles-atomic-openshift-node
Red Hat:openshift:3.1::el7
 before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-3703 is a medium vulnerability (CVSS 5.3) in Redhat Openshift, published June 8, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in atomic-openshift 0:3.1.1.6-8.git.64.80b61da.el7aos.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open