Em resumo
- CVE-2021-20278 é uma vulnerabilidade MÉDIO (CVSS 6.5) que afeta github.com/kiali/kiali, kiali (kiali).
- Chance de exploração nos próximos 30 dias (EPSS): 0.76%, maior que 55.4% das vulnerabilidades.
- Correção: atualize para 1.31.0 ou posterior.
Description
An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy OpenID is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID implicit flow is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.
NVD description
An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID `implicit flow` is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.
Mais vulnerabilidades de github.com/kiali/kiali
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free