Vulnerability · Published Jun 1, 2021 · Assigned by redhat

CVE-2021-3495

High 8.8

In plain English

A high-severity security flaw in kiali/kiali-operator. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High

Exploit odds (30 days)1.0%top 38.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/kiali/kiali	1.33.0	GHSA-mv55-23xp-3wp8
Go	github.com/kiali/kiali	1.33.0	GO-2022-0645

Affected products (as reported)

Vendor	Product	Versions
n/a	kiali/kiali-operator	kiali/kiali-operator 1.33.0, kiali/kiali-operator 1.24.7

Weakness: CWE-281

References

https://bugzilla.redhat.com/show_bug.cgi?id=1947361 x_refsource_MISC
https://kiali.io/news/security-bulletins/kiali-security-003/ x_refsource_MISC