A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2023:0542 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2022-3962 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2148661 | Issue Tracking Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:0542 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2022-3962 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2148661 | Issue Tracking Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
| AND |
|
History
21 Nov 2024, 07:20
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/errata/RHSA-2023:0542 - Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2022-3962 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2148661 - Issue Tracking, Third Party Advisory |
Information
Published : 2023-09-23 20:15
Updated : 2024-11-21 07:20
NVD link : CVE-2022-3962
Mitre link : CVE-2022-3962
CVE.ORG link : CVE-2022-3962
JSON object : View
Products Affected
redhat
- enterprise_linux
- enterprise_linux_for_ibm_z_systems
- openshift_service_mesh
- enterprise_linux_for_power_little_endian_eus
kiali
- kiali
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
NVD-CWE-noinfo