Fiche vulnérabilité
CVE-2020-8595 : faille élevée istio istio (CVSS 7.3)
Description
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match.
En bref
- Sévérité
- Élevée (CVSS 7.3)
- Vecteur CVSS
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Exploitation active
- Non signalée par la CISA
- Publication
- 12 févr. 2020
- Dernière mise à jour
- 17 juin 2026
Produits concernés
- istio istio
- redhat openshift service mesh