En resumen
- CVE-2021-20278 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a github.com/kiali/kiali, kiali (kiali).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.76%, mayor que el 55.4% de las vulnerabilidades.
- Solución: actualizar a 1.31.0 o posterior.
Description
An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy OpenID is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID implicit flow is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.
NVD description
An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID `implicit flow` is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.
Más vulnerabilidades de github.com/kiali/kiali
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free