CVE-2020-1762

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-384 CWE-613

Affected software

Vendor	Product	Versions
[Kiali]	kiali	>= 0.4.0, < 1.15.1

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1762Issue Tracking, Third Party Advisory
https://kiali.io/news/security-bulletins/kiali-security-001/Mitigation, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1762Issue Tracking, Third Party Advisory
https://kiali.io/news/security-bulletins/kiali-security-001/Mitigation, Vendor Advisory

Timeline

Published: Apr 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-17637.5An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker CVE-2020-17648.6A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote at CVE-2020-17655.3An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, A CVE-2020-17666.1Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malic CVE-2020-17674.3Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the na CVE-2020-17685.4The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the Sessi CVE-2020-17694.3In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security CVE-2020-17704.3Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Comm CVE-2020-17715.4Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, J CVE-2020-17727.5It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated CVE-2020-17738.1An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-202 CVE-2020-17744.9When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix