GitHub Advisoryadvisory · Go

GHSA-465w-gg5p-85c9 Insufficient Session Expiration in Kiali

HIGH Published 2021-05-18 Modified 2021-05-18 Official page ↗
Aliases
CVE-2020-1762
Ecosystem
Go
Packages
github.com/kiali/kiali
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weaknesses
CWE-295, CWE-384, CWE-613
Reviewed
2021-05-18

Affected packages

• Go github.com/kiali/kiali: >= 0.4.0, < 1.15.1 → fixed in 1.15.1

Description

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2020-1762 An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a… vulnerability

Weakness · CWE (2)

  • CWE-295 Improper Certificate Validation weakness
  • CWE-384 Session Fixation weakness

References