VDB
CVE-2020-1762
CVE-2020-1762
PUBLISHED
CVSS 7 HIGH
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.
EPSS 1.13% · 63.2th percentile
Risk Scores
CVSS 3.1
7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
EPSS Score
1.13%
63.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| redhat | openshift_service_mesh | 1.0 |
| github.com | kiali/kiali | 0.4.0 |
| [Kiali] | kiali | >= 0.4.0, < 1.15.1 |
| kiali | kiali | 0.4.0 |
Timeline
- Apr 27, 2020 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Jan 8, 2023 EPSS Score
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1762 url
- https://kiali.io/news/security-bulletins/kiali-security-001/ url
- https://nvd.nist.gov/vuln/detail/CVE-2020-1762 advisory
- https://github.com/kiali/kiali/commit/93f5cd0b6698e8fe8772afb8f35816f6c086aef1 url
- https://github.com/kiali/kiali/commit/c91a0949683976f621cca213c1193831d63b381c url
- https://bugzilla.redhat.com/show_bug.cgi?id=1810387 url
- https://kiali.io/news/security-bulletins/kiali-security-001 url