Vulnerability · Published Feb 4, 2022 · Assigned by Mirantis

CVE-2022-0484Improper URL Validation causes Mirantis Container Cloud Lens Extension to open external programs

High 8.8

In plain English

A high-severity improper input validation in Mirantis Container Cloud Lens Extension from Mirantis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.0%top 37.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster. An attacker could host a webserver which serves a malicious Mirantis Container Cloud configuration file and induce the victim to add a new cluster via its URL. This issue affects: Mirantis Mirantis Container Cloud Lens Extension v3 versions prior to v3.1.1.

Affected products (as reported)

Vendor	Product	Versions
Mirantis	Mirantis Container Cloud Lens Extension	v3 – before v3.1.1

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/Mirantis/security/blob/main/advisories/0005.md x_refsource_MISC