A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2023:0542 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2022-3962 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2148661 | Issue Tracking Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:0542 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2022-3962 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2148661 | Issue Tracking Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
| AND |
|
History
21 Nov 2024, 07:20
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/errata/RHSA-2023:0542 - Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2022-3962 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2148661 - Issue Tracking, Third Party Advisory |
26 Sep 2023, 14:24
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:kiali:kiali:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_service_mesh:2.3.1:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.0:*:*:*:*:*:*:* |
|
| First Time |
Redhat
Redhat enterprise Linux Redhat enterprise Linux For Ibm Z Systems Redhat enterprise Linux For Power Little Endian Eus Kiali Kiali kiali Redhat openshift Service Mesh |
|
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| References | (MISC) https://access.redhat.com/errata/RHSA-2023:0542 - Third Party Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2148661 - Issue Tracking, Third Party Advisory | |
| References | (MISC) https://access.redhat.com/security/cve/CVE-2022-3962 - Third Party Advisory |
23 Sep 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-23 20:15
Updated : 2024-11-21 07:20
NVD link : CVE-2022-3962
Mitre link : CVE-2022-3962
CVE.ORG link : CVE-2022-3962
JSON object : View
Products Affected
redhat
- enterprise_linux_for_ibm_z_systems
- openshift_service_mesh
- enterprise_linux_for_power_little_endian_eus
- enterprise_linux
kiali
- kiali
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
NVD-CWE-noinfo