// For flags

CVE-2022-39388

Istio may allow identity impersonation if user has localhost access

Severity Score

3.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.

Istio es una plataforma abierta para conectar, administrar y proteger microservicios. En las versiones de la rama 1.15.x anteriores a la 1.15.3, un usuario puede suplantar cualquier identidad de carga de trabajo dentro de la malla de servicios si tiene acceso de host local al plano de control de Istiod. La versiĆ³n 1.15.3 contiene un parche para este problema. No se conocen workarounds.

*Credits: N/A
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-02 CVE Reserved
  • 2022-11-10 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-863: Incorrect Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Istio
Search vendor "Istio"
Istio
Search vendor "Istio" for product "Istio"
>= 1.15.0 <= 1.15.2
Search vendor "Istio" for product "Istio" and version " >= 1.15.0 <= 1.15.2"
-
Affected