Vulnerability · Published Sep 23, 2023 · Assigned by redhat
CVE-2022-3962Kiali: error message spoofing in kiali ui
Medium 4.3
In plain English
A medium-severity injection in OpenShift Service Mesh 2.1 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/kiali/kiali | 1.57.4 | GHSA-6f4m-j56w-55c3 |
| Go | github.com/kiali/kiali | 1.57.4 | GO-2023-2075 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat OpenShift Service Mesh 2.3 for RHEL 8 | see references |
| Red Hat | OpenShift Service Mesh 2.1 | see references |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- RHSA-2023:0542 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2022-3962 vdb-entry, x_refsource_REDHAT
- RHBZ#2148661 issue-tracking, x_refsource_REDHAT