GitHub Advisory DatabaseGHSA-465W-GG5P-85C9Insufficient Session Expiration in Kiali
8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
67.4%
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/kiali/kiali | ge | 0.4.0 | |
| github.com/kiali/kiali | lt | 1.15.1 |
References
bugzilla.redhat.com/show_bug.cgi?id=1810387
bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1762
github.com/advisories/GHSA-465w-gg5p-85c9
github.com/kiali/kiali/commit/93f5cd0b6698e8fe8772afb8f35816f6c086aef1
github.com/kiali/kiali/commit/c91a0949683976f621cca213c1193831d63b381c
kiali.io/news/security-bulletins/kiali-security-001/
nvd.nist.gov/vuln/detail/CVE-2020-1762
Related
8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
67.4%