Insufficient Session Expiration in Kiali - CVE-2020-1762
Published: April 28, 2020
Vulnerability identifier: #VU27379
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-1762
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to an insufficient JWT validation. A remote non-authenticated attacker can steal a valid JWT cookie and gain unauthorized access to session that belongs to another user, possibly gain privileges to view and alter the Istio configuration.
Affected software
Kiali
How to mitigate CVE-2020-1762
Install updates from vendor's website.
Kiali - update to 1.15.1