LiveActive security incident?Get immediate response
CVE Record

CVE-2016-3703: Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous ac...

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE affects legacy Red Hat OpenShift Enterprise 3.1 and 3.2. In specific anonymous proxy-access configurations, the platform could mishandle request origin validation and expose API credentials stored in a browser. The business concern is unauthorized access to cluster API credentials, especially in old environments that remain internet-accessible or unmanaged.

Executive priority

Treat this as a legacy-platform risk requiring confirmation, not an automatically urgent current-platform incident. Prioritize if old OpenShift 3.1 or 3.2 clusters still exist, especially where anonymous proxy API access or external reachability is present.

Technical view

The issue is improper request-origin validation when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod. The CVE states remote attackers could access API credentials in browser localStorage through an access_token query parameter. The source bundle provides no CVSS score, CWE, CPE list, or detailed package-level affected matrix.

Likely exposure

Exposure appears limited to Red Hat OpenShift Enterprise 3.1 or 3.2 deployments with anonymous access enabled for affected proxy API paths. Modern OpenShift versions are not named in the provided sources, and the bundle does not include enough detail to infer broader product exposure.

Exploitation context

The provided sources do not report active exploitation, and the CVE is not listed as CISA KEV in the bundle. The described attack is remote but depends on a specific anonymous-access configuration and browser token handling. No exploit maturity, public exploit, or observed abuse evidence is provided.

Researcher notes

Key missing data includes CVSS, CWE, exact affected packages, fixed versions, and exploit evidence. Analysis should stay tied to the CVE description and Red Hat errata. Do not assume Kubernetes or other OpenShift releases are affected unless vendor guidance confirms it.

Mitigation direction

  • Identify any Red Hat OpenShift Enterprise 3.1 or 3.2 clusters still operating.
  • Review RHSA-2016:1094 and RHSA-2016:1095 and apply relevant vendor updates.
  • Remove unnecessary anonymous access to service/proxy and pod/proxy API paths.
  • Follow current Red Hat guidance for unsupported legacy OpenShift environments.

Validation and detection

  • Inventory cluster versions and confirm whether OpenShift Enterprise 3.1 or 3.2 is present.
  • Review API authorization rules for anonymous service/proxy and pod/proxy access.
  • Check browser-side handling for API tokens and query-string token exposure.
  • Confirm Red Hat errata packages or equivalent remediations are installed.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2016-3703 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.