GitHub Advisoryadvisory · Go

GHSA-6f4m-j56w-55c3 Kiali content spoofing vulnerability

MEDIUM Published 2023-09-23 Modified 2023-09-25 Official page ↗
Aliases
CVE-2022-3962
Ecosystem
Go
Packages
github.com/kiali/kiali
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-74
Reviewed
2023-09-25

Affected packages

• Go github.com/kiali/kiali: < 1.57.4 → fixed in 1.57.4

Description

A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.

Related

Alias · CVE (1)

  • CVE-2022-3962 A content spoofing vulnerability was found in Kiali. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References