Medium severity · published Sep 23, 2023
CVE-2022-3962
A content spoofing vulnerability was found in Kiali
4.3
CVSS
0.7%
EPSS
No
On KEV
Description
A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
Kiali · Kiali
All versions, or not specified · source: NVD
OS
Openshift Service Mesh · Redhat
2.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3962
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3962
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:0542
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-3962
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2148661
More from Kiali
8.6
CVE-2020-1762
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by…
8.6
CVE-2020-1764
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1
6.5
CVE-2021-20278
An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used