Vulnerability · Published Sep 16, 2020 · Assigned by redhat
CVE-2020-14306
High 8.8
In plain English
A high-severity missing authorization in openshift-service-mesh/istio-rhel8-operator. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Official description
An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3. This flaw allows an attacker with a basic level of access to the cluster to deploy a custom gateway/pod to any namespace, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | openshift-service-mesh/istio-rhel8-operator | all versions through 1.1.3 |
Weakness: CWE-862