CVE-2020-1762
Fixed in a distro release EPSS 1%CVSS 7.0
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.
Products: [Kiali] kiali
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/kiali/kiali | 1.15.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat:service_mesh:1.0 | jaeger | 0:v1.13.1.redhat6-1.el7 |
| Red Hat:service_mesh:1.0 | kiali | 0:v1.0.10.redhat1-1.el7 |