PT-2023-13726 · Kiali · Kiali

John Mazzitelli + 1 · Publicado 2023-09-23 · Atualizado 2024-08-21 · CVE-2022-3962

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kiali (affected versions not specified)

Description A content spoofing issue was found in Kiali, where it does not implement error handling when the page or endpoint being accessed cannot be found. This allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2022-3962

GHSA-6F4M-J56W-55C3

GO-2023-2075

Produtos afetados

Kiali

Referências · 13

• https://github.com/kiali/kiali/commit/aab7694f850f04d7fd875fac5f720a93ccdf01ad · Nota
• https://github.com/kiali/kiali · Nota
• https://t.me/cibsecurity/70964 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-3962 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-6f4m-j56w-55c3 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2023:0542 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-3962 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=2148661 · Nota
• https://t.me/cvenotify/58519 · Publicação no Telegram
• https://osv.dev/vulnerability/GO-2023-2075 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2022-3962 · Nota
• https://github.com/advisories/GHSA-6f4m-j56w-55c3 · Nota
• https://issues.redhat.com/browse/OSSM-2251?attachmentViewMode=list · Nota