PT-2021-20792 · Unknown · Kiali-Operator

Marian Rehak + 1 · Published 2021-06-01 · Updated 2024-08-21 · CVE-2021-3495

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: kiali-operator versions prior to 1.33.0 kiali-operator versions prior to 1.24.7

Description: An incorrect access control flaw was found in the kiali-operator. This flaw allows an attacker with a basic level of access to the cluster to deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this flaw is to data confidentiality and integrity as well as system availability.

Recommendations: For versions prior to 1.33.0, update to version 1.33.0 or later. For versions prior to 1.24.7, update to version 1.24.7 or later. As a temporary workaround, consider restricting access to the cluster to minimize the risk of exploitation.

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2021-3495

GHSA-MV55-23XP-3WP8

GO-2022-0645

Affected Products

Kiali-Operator

References · 9

• https://osv.dev/vulnerability/GO-2022-0645 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3495 · Security Note
• https://kiali.io/news/security-bulletins/kiali-security-003 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1947361 · Patch
• https://osv.dev/vulnerability/CVE-2021-3495 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mv55-23xp-3wp8 · Vendor Advisory
• https://github.com/kiali/kiali-operator/pull/278 · Note
• https://github.com/advisories/GHSA-mv55-23xp-3wp8 · Note
• https://t.me/cvenotify/16258 · Telegram Post