Insufficient Session Expiration in Kiali · CVE-2020-1762 · GitHub Advisory Database · GitHub

Insufficient Session Expiration in Kiali

High severity GitHub Reviewed Published May 18, 2021 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

github.com/kiali/kiali (Go)

Affected versions

>= 0.4.0, < 1.15.1

Patched versions

1.15.1

Description

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

References

Reviewed May 18, 2021

Published to the GitHub Advisory Database May 18, 2021

Last updated Jan 9, 2023

Severity

High

8.6

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H