Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: [Kiali] Component: Kiali Clear all filters
TI-2022-03631 CVE-2022-3962 · GHSA-6f4m-j56w-55c3

Kiali: error message spoofing in kiali ui

Priority LOW 21

A content spoofing vulnerability was found in Kiali.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00738 Published 2023-09-23 Partial fix · 1.57.5-3, 1.57.4 CWE-74
TI-2021-03569 CVE-2021-20278 · GHSA-ggjr-2f7v-vhq4

Authentication bypass by spoofing in kiali

Priority LOW 30

An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00763 Published 2021-05-28 Fixed in 1.31.0 CWE-290
TI-2020-01705 CVE-2020-1762 · GHSA-465w-gg5p-85c9

Session fixation in [Kiali] kiali

Priority MEDIUM 40

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using tha…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01153 Published 2020-04-27 Fixed in 1.15.1 CWE-384
TI-2020-01707 CVE-2020-1764 · GHSA-64rh-r86q-75ff

Hard-coded credentials in Red Hat kiali

Priority MEDIUM 43

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.03468 Published 2020-03-26 Fixed in 1.15.1 CWE-321