CVE-2022-0484
Assigner: Mirantis
Published: 2022-02-03T00:00:00
State: PUBLISHED
affected: product: Mirantis Container Cloud Lens Extension
vendor: Mirantis
versions: lessThan: v3.1.1
status: affected
version: v3
versionType: custom
credits: value: Mirantis PSIRT
datePublic: 2022-02-03T00:00:00
descriptions: value: Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster. An attacker could host a webserver which serves a malicious Mirantis Container Cloud configuration file and induce the victim to add a new cluster via its URL. This issue affects: Mirantis Mirantis Container Cloud Lens Extension v3 versions prior to v3.1.1.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-20
description: CWE-20 Improper Input Validation
type: CWE
source: advisory: 0005
discovery: INTERNAL
title: Improper URL Validation causes Mirantis Container Cloud Lens Extension to open external programs
x_generator: engine: Vulnogram 0.0.9