CVE-2020-1762 Insufficient Session Expiration in Kiali
Remote attackers can steal JWT cookies to spoof user sessions and gain unauthorized access to view or modify Istio configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-1762?
CVE-2020-1762 is a high-severity authentication bypass vulnerability in [Kiali] kiali, published on 27 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.
Which versions are affected by CVE-2020-1762?
3 open source packages ship an affected version, including github.com/kiali/kiali. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kiali/kiali Go | From 0.4.0 | 1.15.1 |
github.com/kiali/kiali Go | From 0.4.0 | 1.15.1 |
github.com/kiali/kiali Go | From 0.4.0 | 1.15.1 |
Products include Kiali Kiali, Redhat Openshift Service Mesh.
How do I fix CVE-2020-1762?
Upgrade github.com/kiali/kiali to 1.15.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-1762 being exploited?
There is no known exploitation of CVE-2020-1762 in the wild and no public exploit code.
Other vulnerabilities in [Kiali] kiali
Sources
Also known as GHSA-465w-gg5p-85c9, GO-2022-0626.