Every CVESearch/Get API key

CVE-2016-3703

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when...

5.3 MediumFix available

CVE-2016-3703 is a medium vulnerability (CVSS 5.3) in Redhat Openshift, published June 8, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 68th percentile. Fixed in atomic-openshift 0:3.1.1.6-8.git.64.80b61da.el7aos.

What does this mean?
Severity
5.3 MediumCVSS 3.0, NVD
Exploit chance
1.18%EPSS, 68th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0:3.1.1.6-8.git.64.80b61da.el7aosatomic-openshift +21 more

Description

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.18%Up 0.1 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
atomic-openshift
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-clients
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-clients-redistributable
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-dockerregistry
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-master
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-node
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-pod
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-recycle
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-sdn-ovs
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift-tests
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
Show 12 moreShow less
Affected packages
PackageAffectedFixed
nodejs-node-uuid
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
before 0:1.4.7-1.el7
0:1.4.7-1.el7
tuned-profiles-atomic-openshift-node
Red Hat:openshift:3.2::el7
From an advisory covering 3 CVEs
before 0:3.2.0.44-1.git.0.a4463d9.el7
0:3.2.0.44-1.git.0.a4463d9.el7
atomic-openshift
Red Hat:openshift:3.1::el7
before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-clients
Red Hat:openshift:3.1::el7
before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-clients-redistributable
Red Hat:openshift:3.1::el7
before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-dockerregistry
Red Hat:openshift:3.1::el7
before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-master
Red Hat:openshift:3.1::el7
before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-node
Red Hat:openshift:3.1::el7
before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-pod
Red Hat:openshift:3.1::el7
before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-recycle
Red Hat:openshift:3.1::el7
before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
atomic-openshift-sdn-ovs
Red Hat:openshift:3.1::el7
before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos
tuned-profiles-atomic-openshift-node
Red Hat:openshift:3.1::el7
before 0:3.1.1.6-8.git.64.80b61da.el7aos
0:3.1.1.6-8.git.64.80b61da.el7aos

What each source reports

NVD Score used5.3

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.

Record
CVE-2016-3703
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:P/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02
CVE ListNo score

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.

Record
CVE-2016-3703
Updated
2026-11-02
EUVDEUVD-2016-4724No score

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.

Record
EUVD-2016-4724
Updated
2026-11-03
GitHub AdvisoriesGHSA-xhrq-h87x-w62q5.3

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when...

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.

Record
GHSA-xhrq-h87x-w62q
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 18 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open