CVE-2015-3207 — github.com/openshift/origin: Insecure cookies in Openshift Origin in github.com/openshift/origin

MEDIUM

github.com/openshift/origin: Insecure cookies in Openshift Origin in github.com/openshift/origin

Published Jul 7, 2022

5.3

MEDIUM

CVSS 3.1

EPSS 0.74%

In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Openshift Origin

n/a

Version	Status	Constraints
Openshift Origin 3	affected	-

Logging Subsystem for Red Hat OpenShift

openshift-logging/elasticsearch6-rhel8

Not affected
Logging Subsystem for Red Hat OpenShift

openshift-logging/logging-curator5-rhel8

Not affected
Red Hat OpenShift Container Platform 4

openshift4/ose-tests

Not affected
Red Hat OpenShift Virtualization 4

container-native-virtualization/cluster-network-addons-operator

Not affected
Red Hat OpenShift Virtualization 4

container-native-virtualization/cluster-network-addons-operator-rhel9

Not affected
Red Hat OpenStack Platform 16.2

osp-director-provisioner-container

Not affected

Product	Package	State	Advisory
Logging Subsystem for Red Hat OpenShift	openshift-logging/elasticsearch6-rhel8	Not affected	n/a
Logging Subsystem for Red Hat OpenShift	openshift-logging/logging-curator5-rhel8	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift4/ose-tests	Not affected	n/a
Red Hat OpenShift Virtualization 4	container-native-virtualization/cluster-network-addons-operator	Not affected	n/a
Red Hat OpenShift Virtualization 4	container-native-virtualization/cluster-network-addons-operator-rhel9	Not affected	n/a
Red Hat OpenStack Platform 16.2	osp-director-provisioner-container	Not affected	n/a

Ecosystem	Package	Introduced	Fixed
Go	github.com/openshift/origin	0	1.0.0

No remediation recorded yet.

0.74% 0.00739

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00739

2022–2026

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.74% (0.00739)	52.90th	v5 (v2026.06.15)
Jun 15, 2026	0.57% (0.00571)	42.53th	v5 (v2026.06.15)
Mar 17, 2025	0.06% (0.00058)	15.43th	v4 (v2025.03.14)
Dec 12, 2024	0.07% (0.00072)	33.10th	v3 (v2023.03.01)
Jun 26, 2024	0.07% (0.00072)	31.19th	v3 (v2023.03.01)
Dec 18, 2023	0.07% (0.00070)	29.18th	v3 (v2023.03.01)
Aug 9, 2023	0.06% (0.00064)	26.19th	v3 (v2023.03.01)
Jun 7, 2023	0.06% (0.00056)	21.46th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00052)	18.56th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Feb 17, 2023	0.95% (0.00954)	36.00th	v2 (v2022.01.01)
Jul 15, 2022	0.95% (0.00954)	33.99th	v2 (v2022.01.01)
Jul 8, 2022	0.89% (0.00890)	27.85th	v2 (v2022.01.01)

Weaknesses (3)

CWE-311

Missing Encryption of Sensitive Data

CWE-565

CWE-614

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2015-3207		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1221882		x_refsource_MISCPermissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2105433		Issue Tracking
https://github.com/advisories/GHSA-rqph-25q9-9jhp		Advisory
https://github.com/openshift/origin/pull/2261		x_refsource_MISCPatchThird Party Advisory
https://github.com/openshift/origin/pull/2291		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-3207
https://www.cve.org/CVERecord?id=CVE-2015-3207