Hard coded cryptographic key in Kiali · CVE-2020-1764 · GitHub Advisory Database · GitHub

Hard coded cryptographic key in Kiali

High severity GitHub Reviewed Published May 18, 2021 to the GitHub Advisory Database • Updated Oct 2, 2023

Package

github.com/kiali/kiali (Go)

Affected versions

< 1.15.1

Patched versions

1.15.1

Description

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.

References

Reviewed May 6, 2021

Published to the GitHub Advisory Database May 18, 2021

Last updated Oct 2, 2023

Severity

High

8.6

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H