CVE-2021-20278

Katalog CVE

CVSS 6.5 · Medium EPSS 0,76%

Kerentanan Authentication Bypass by Spoofing pada kiali. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID `implicit flow` is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.

Rincian

Terbit di NVD

28 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing
CWE-287: Improper Authentication

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 54,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://kiali.io/news/security-bulletins/kiali-security-002/ advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=1937171 issue tracking · patch · advisory pihak ketiga