CVE-2022-3962

Kiali: error message spoofing in kiali ui

CVSS 4.3 MEDIUMEPSS 0.7%CWE-74

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.3EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

23 set 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Produtos afetados

Red Hat · OpenShift Service Mesh 2.1 Red Hat · Red Hat OpenShift Service Mesh 2.3 for RHEL 8

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://access.redhat.com/errata/RHSA-2023:0542 https://access.redhat.com/security/cve/CVE-2022-3962 https://bugzilla.redhat.com/show_bug.cgi?id=2148661