CVE-2020-1762

—

CVSS 3.1

8.6 high

EPSS

1%p64

Published

Apr 27, 2020 (Apr 27, 2020)

Modified

Jun 17, 2026

Description

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

Vendors: kiali redhat
Products: kiali, openshift service mesh
Weakness: CWE-384, CWE-613
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news0 stories

No ingested article mentions this CVE yet.