CVE-2020-1762

moderate-risk
Published 2020-04-27

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

Do I need to act?

-
0.58% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.0/10 High
NETWORK / HIGH complexity

Affected Products (2)

Kiali

Affected Vendors

Redhat Kiali

References (4)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1762
Mitigation https://kiali.io/news/security-bulletins/kiali-security-001/
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1762
Mitigation https://kiali.io/news/security-bulletins/kiali-security-001/
30
/ 100
moderate-risk
Severity 21/34 · High
Exploitability 2/34 · Minimal
Exposure 7/34 · Low