Insufficiently Protected Credentials Affecting github.com/kiali/kiali/config package, versions <1.16.0-snapshot.1


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
0.21% (60th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-GOLANG-GITHUBCOMKIALIKIALICONFIG-561354
  • published26 Mar 2020
  • disclosed26 Mar 2020
  • creditUnknown

Introduced: 26 Mar 2020

CVE-2020-1764  (opens in a new tab)
CWE-321  (opens in a new tab)

How to fix?

Upgrade github.com/kiali/kiali/config to version 1.16.0-snapshot.1 or higher.

Overview

github.com/kiali/kiali/config is a package part of Kiali project.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials. A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration

CVSS Scores

version 3.1