CVE-2020-14306: istio-operator project istio-operator

csirt@kutim:~/threat-intel/cve/CVE-2020-14306

CVSS 8.8 · High EPSS 1,3%

Kerentanan Missing Authorization pada istio-operator project istio-operator. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3. This flaw allows an attacker with a basic level of access to the cluster to deploy a custom gateway/pod to any namespace, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Rincian

Terbit di NVD: 16 September 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 1,3% peluang dieksploitasi; lebih tinggi dari 69,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
istio-operator project	istio-operator	Semua versi hingga 1.1.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/maistra/istio-operator/pull/462 patch · advisory pihak ketiga
https://bugzilla.redhat.com/show_bug.cgi?id=1850380 issue tracking · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.