{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "CSRF due to reused Oauth2 state",
    "tracking": {
      "current_release_date": "2026-08-11T16:54:26+00:00",
      "generator": {
        "date": "2026-08-11T16:54:26+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.3.0"
        }
      },
      "id": "CVE-2023-31999",
      "initial_release_date": "2023-07-04T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-08-11T16:54:26+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat OpenShift Dev Spaces 3.29.0.GA",
            "product": {
              "name": "Red Hat OpenShift Dev Spaces 3.29.0.GA",
              "product_id": "rhos_devspaces-3",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift_devspaces:3"
              }
            }
          },
          {
            "category": "product_version",
            "name": "devspaces/dashboard-rhel8",
            "product": {
              "name": "devspaces/dashboard-rhel8",
              "product_id": "devspaces/dashboard-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/dashboard-rhel8?repository_url=registry.redhat.io/devspaces/dashboard-rhel8"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devspaces/dashboard-rhel8 as a component of Red Hat OpenShift Dev Spaces 3.29.0.GA",
          "product_id": "rhos_devspaces-3:devspaces/dashboard-rhel8"
        },
        "product_reference": "devspaces/dashboard-rhel8",
        "relates_to_product_reference": "rhos_devspaces-3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-31999",
      "cwe": {
        "id": "CWE-352",
        "name": "Cross-Site Request Forgery (CSRF)"
      },
      "discovery_date": "2023-07-05T00:00:00+00:00",
      "notes": [
        {
          "category": "description",
          "text": "A Cross-Site Request Forgery (CSRF) flaw was found in Oauth2. This issue exists due to the state parameter being statically generated at startup time and used across all requests for all users. An attacker could use the value of the state parameter to create forged requests on behalf of other users or other sessions of the same user.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "rhos_devspaces-3:devspaces/dashboard-rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-31999"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31999"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-31999"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "rhos_devspaces-3:devspaces/dashboard-rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "baseScore": 7.4,
            "baseSeverity": "HIGH"
          },
          "products": [
            "rhos_devspaces-3:devspaces/dashboard-rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "rhos_devspaces-3:devspaces/dashboard-rhel8"
          ]
        }
      ],
      "title": "CSRF due to reused Oauth2 state"
    }
  ]
}