CVE-2022-3962

2023-09-2320:15:10

CWE-74

[email protected]

web.nvd.nist.gov

content spoofing

kiali

vulnerability

arbitrary text injection

error handling

url

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

25.6%

JSON

A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.

Affected configurations

Nvd

Node

kialikialiMatch-

Node

redhatenterprise_linuxMatch8.0

redhatenterprise_linux_for_ibm_z_systemsMatch8.0

redhatenterprise_linux_for_power_little_endian_eusMatch8.0

AND

redhatopenshift_service_meshMatch2.3.1

VendorProductVersionCPE
kialikiali-cpe:2.3:a:kiali:kiali:-:*:*:*:*:*:*:*
redhatenterprise_linux8.0cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
redhatenterprise_linux_for_ibm_z_systems8.0cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*
redhatenterprise_linux_for_power_little_endian_eus8.0cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.0:*:*:*:*:*:*:*
redhatopenshift_service_mesh2.3.1cpe:2.3:a:redhat:openshift_service_mesh:2.3.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
kiali	kiali	-	cpe:2.3:a:kiali:kiali:-:::::::*
redhat	enterprise_linux	8.0	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
redhat	enterprise_linux_for_ibm_z_systems	8.0	cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:::::::*
redhat	enterprise_linux_for_power_little_endian_eus	8.0	cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.0:::::::*
redhat	openshift_service_mesh	2.3.1	cpe:2.3:a:redhat:openshift_service_mesh:2.3.1:::::::*