Access control flaw in Kiali in github.com/kiali/kiali
Summary
CVE-2021-3495: Access control flaw in Kiali in github.com/kiali/kiali. Affects github.com/kiali/kiali versions < 1.33.0. Fixed in 1.33.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kiali is a package in the Go ecosystem that provides observability and management features for service mesh deployments. It is commonly used in microservices architectures to monitor and visualize the traffic flow between services. However, a vulnerability has been discovered in Kiali that affects its access control mechanism.
Vulnerability Detail
The access control flaw in Kiali allows unauthorized users to bypass authentication and gain unauthorized access to sensitive information or perform unauthorized actions within the system. This vulnerability can lead to data breaches, privilege escalation, and other security risks. The flaw originates from a flaw in the access control implementation in the affected versions of Kiali.
How To Fix
Minimum fixed version
1.33.0
This is the first release that contains the fix.
go get github.com/kiali/kiali@v1.33.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The access control flaw in Kiali poses a significant security risk as it allows unauthorized access to sensitive information and unauthorized actions within the system. It is crucial for developers to upgrade to the fixed version to mitigate this vulnerability.
See every vulnerability recorded for github.com/kiali/kiali →
FAQ
Kiali is a package in the Go ecosystem that provides observability and management features for service mesh deployments.
The vulnerability allows unauthorized users to bypass authentication and gain unauthorized access to sensitive information or perform unauthorized actions within the system.
To fix this vulnerability, upgrade to version 1.33.0 or later of the github.com/kiali/kiali package.
No specific workarounds have been mentioned for this vulnerability.
You can find more information about this vulnerability in the vulnerability database at https://pkg.go.dev/vuln/GO-2022-0645.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/kiali/kiali.
