~ / search / GHSA-465w-gg5p-85c9

GHSA-465w-gg5p-85c9

Insufficient Session Expiration in Kiali

Source: GitHub Advisory Database (reviewed) High CVE-2020-1762

Packages

EcosystemPackageAffectedFixed in
Go github.com/kiali/kiali >= 0.4.0, < 1.15.1 1.15.1

Details

As written in the advisory (Markdown source, shown as plain text).

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

References

External links from the advisory. They lead to third-party sites.