PT-2022-24947 · Istio · Istio
CVSS v3.1
7.6
High
| Vector | AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Istio versions 1.15.x prior to 1.15.3
Description
A user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane.
Recommendations
For versions prior to 1.15.3, upgrade to version 1.15.3 or later to resolve the issue.
As a temporary workaround, consider restricting localhost access to the Istiod control plane until a patch is applied.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Istio