CVE-2020-1762CWE-384CWE-613

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could…

High · published April 27, 2020

CVSS v3.1
7.0
EPSS
1%
Percentile
66.7
In the wild
Unconfirmed
What it is

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.01153 · 66.7th percentile
Weaknesses
CWE-384 · Session Fixation; CWE-613 · Insufficient Session Expiration
Published
2020-04-27T20:41Z
EPSS history
Timeline
  • 27 APR 20:41Z
    An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could…
    cvelistv5