En bref
- CVE-2021-20278 est une vulnérabilité MOYENNE (CVSS 6.5) touchant github.com/kiali/kiali, kiali (kiali).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.76%, plus élevée que 55.4% des vulnérabilités.
- Correctif : mettre à jour vers 1.31.0 ou plus récent.
Description
An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy OpenID is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID implicit flow is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.
NVD description
An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID `implicit flow` is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.
Autres vulnérabilités de github.com/kiali/kiali
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free