x/vulndb: potential Go vuln in github.com/openshift/console: GHSA-v3w7-g6p2-mpx7

[GoVulnBot]

Advisory GHSA-v3w7-g6p2-mpx7 references a vulnerability in the following Go modules:

Module
github.com/openshift/console

Description:
A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system.
The /api/dev-console/proxy/internet endpoint on the OpenShit Console allows authenticated users to ha...

References:

• ADVISORY: GHSA-v3w7-g6p2-mpx7
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-6538
• WEB: https://access.redhat.com/security/cve/CVE-2024-6538
• WEB: https://bugzilla.redhat.com/show_bug.cgi?id=2296057

Cross references:

• github.com/openshift/console appears in 3 other report(s):
  • data/excluded/GO-2023-2208.yaml (x/vulndb: potential Go vuln in github.com/openshift/console: CVE-2018-10937 #2208) LEGACY_FALSE_POSITIVE
  • data/reports/GO-2024-3083.yaml (x/vulndb: potential Go vuln in github.com/openshift/console: GHSA-4crf-28c7-v4gr #3083)
  • data/reports/GO-2024-3211.yaml (x/vulndb: potential Go vuln in github.com/openshift/console: CVE-2024-50312 #3211)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/openshift/console
      vulnerable_at: 6.0.6+incompatible
summary: OpenShift Console Server Side Request Forgery vulnerability in github.com/openshift/console
cves:
    - CVE-2024-6538
ghsas:
    - GHSA-v3w7-g6p2-mpx7
references:
    - advisory: https://github.com/advisories/GHSA-v3w7-g6p2-mpx7
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-6538
    - web: https://access.redhat.com/security/cve/CVE-2024-6538
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=2296057
source:
    id: GHSA-v3w7-g6p2-mpx7
    created: 2024-11-25T18:01:16.522198129Z
review_status: UNREVIEWED