CVE-2022-3962

medium

Description

A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.

References

Advisories

https://bugzilla.redhat.com/show_bug.cgi?id=2148661

https://access.redhat.com/security/cve/CVE-2022-3962

https://access.redhat.com/errata/RHSA-2023:0542

Details

Source: Mitre, NVD

Published: 2023-09-23

Updated: 2023-11-07

Named Vulnerability: Kiali content spoofing vulnerability

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 4.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Severity: Medium

EPSS

EPSS: 0.00107