7.6

CVE-2022-39388

Istio may allow identity impersonation if user has localhost access

Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Istio ≫ Istio Version >= 1.15.0 <= 1.15.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.36
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 3.5 2.1 1.4
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
security-advisories@github.com 7.6 2.3 4.7
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://github.com/istio/istio/commit/346260e5115e9fbc65ba8a559bc686e6ca046a32
Patch
Third Party Advisory
https://github.com/istio/istio/commit/9a643e270421560afb2630e00f76d46a55499df9
Patch
Third Party Advisory
https://github.com/istio/istio/security/advisories/GHSA-6c6p-h79f-g6p4
Third Party Advisory
https://istio.io/latest/news/releases/1.15.x/announcing-1.15.3/
Vendor Advisory
Release Notes