CVE-2022-39388CWE-863

Istio may allow identity impersonation if user has localhost access

High · published November 10, 2022

CVSS v3.1
7.6
EPSS
0%
Percentile
41.4
In the wild
Unconfirmed
What it is

Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00493 · 41.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2022-11-10T00:00Z
EPSS history
Timeline
  • 10 NOV 00:00Z
    Istio may allow identity impersonation if user has localhost access
    cvelistv5