GHSA-ggjr-2f7v-vhq4

Source

https://github.com/advisories/GHSA-ggjr-2f7v-vhq4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-ggjr-2f7v-vhq4/GHSA-ggjr-2f7v-vhq4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-ggjr-2f7v-vhq4

Aliases

Published

2021-06-01T21:57:08Z

Modified

2024-08-21T15:41:55.789181Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Kiali Authentication Bypass vulnerability

Details

An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy OpenID is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID implicit flow is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.

Database specific

{
    "nvd_published_at": "2021-05-28T11:15:00Z",
    "github_reviewed_at": "2021-06-01T17:44:07Z",
    "github_reviewed": true,
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-287",
        "CWE-290"
    ]
}

References

Affected packages

Go / github.com/kiali/kiali

Package

Name: github.com/kiali/kiali; View open source insights on deps.dev
Purl: pkg:golang/github.com/kiali/kiali

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.31.0