Kiali content spoofing vulnerability
A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-3962US | medium4.3 | — | ||
A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This i… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2023:0542WEB
- https://access.redhat.com/security/cve/CVE-2022-3962WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2148661WEB
- https://github.com/kiali/kialiPACKAGE
- https://github.com/kiali/kiali/commit/aab7694f850f04d7fd875fac5f720a93ccdf01adWEB
- https://issues.redhat.com/browse/OSSM-2251?attachmentViewMode=listWEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-3962ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan