CVE-2020-1764
Severity
8.6HIGH
EPSS
6.1%
top 9.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 26
Latest updateAug 21
Description
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HExploitability: 3.9 | Impact: 4.7
Affected Packages4 packages
🔴Vulnerability Details
4CVEList▶
CVE-2020-1764: A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1↗2020-03-26