Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2021-3495

Опубликовано: 11 мая 2021
Источник: redhat
CVSS3: 8.8
EPSS Низкий

Описание

An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

An incorrect access control flaw was found in the kiali-operator. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Отчет

In regards to the ServiceMesh openshift-service-mesh/kiali-rhel7 container, it has been superseded by the openshift-service-mesh/kiali-rhel8 container and is no longer supported.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
OpenShift Service Mesh 1openshift-service-mesh/kiali-rhel7-operatorOut of support scope
OpenShift Service Mesh 2.0openshift-service-mesh/kiali-rhel8-operatorFixedRHSA-2021:154411.05.2021

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-281
https://bugzilla.redhat.com/show_bug.cgi?id=1947361kiali/kiali-operator: can deploy specified image to any namespace

EPSS

Процентиль: 56%
0.00339
Низкий

8.8 High

CVSS3

Связанные уязвимости

CVSS3: 8.8
nvd
больше 4 лет назад

An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS3: 8.8
github
больше 4 лет назад

Access control flaw in Kiali

EPSS

Процентиль: 56%
0.00339
Низкий

8.8 High

CVSS3