Описание
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match.
Ссылки
- Third Party Advisory
- MitigationThird Party Advisory
- Issue TrackingMitigationThird Party Advisory
- Patch
- Vendor Advisory
- PatchVendor Advisory
- Third Party Advisory
- MitigationThird Party Advisory
- Issue TrackingMitigationThird Party Advisory
- Patch
- Vendor Advisory
- PatchVendor Advisory
Уязвимые конфигурации
Одно из
Одновременно
EPSS
7.3 High
CVSS3
7.5 High
CVSS2
Дефекты
Связанные уязвимости
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match.
Istio 1.3 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match.
Уязвимость сетевого программного средства Istio, связанная с ошибками аутентификации, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
EPSS
7.3 High
CVSS3
7.5 High
CVSS2