8.6
CVE-2020-1764
- EPSS 3.47%
- Veröffentlicht 26.03.2020 13:15:13
- Zuletzt bearbeitet 21.11.2024 05:11:20
- Quelle secalert@redhat.com
- CVE-Watchlists
- Unerledigt
LoginA hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Openshift Service Mesh Version1.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 3.47% | 0.875 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.6 | 3.9 | 4.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
| secalert@redhat.com | 8.6 | 3.9 | 4.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
|
CWE-321 Use of Hard-coded Cryptographic Key
The product uses a hard-coded, unchangeable cryptographic key.
CWE-798 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1764
https://kiali.io/news/security-bulletins/kiali-security-001/