What is CVE-2020-14306?

CVE-2020-14306 is a high-severity vulnerability in Istio-Operator Project, classified under Missing Authorization. CVSS score: 8.8/10. Published 2020-09-16.

How severe is CVE-2020-14306?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2020-14306 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Istio-Operator Project

CVE-2020-14306

An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3. This flaw allows an attacker with a basic level of access to the cluster to deploy a custom gateway/pod to any namespace, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Vulnerability class: Broken Access Control

EPSS: 0.013 (67.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Istio-operator_project Istio-operator
N/a Openshift-service-mesh/istio-rhel8-operator — versions all versions through 1.1.3

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

Live-Hack-CVE/CVE-2020-14306

References

secalert@redhat.com (Patch, Third Party Advisory)
secalert@redhat.com (Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2020-14306?: CVE-2020-14306 is a high-severity vulnerability in Istio-Operator Project, classified under Missing Authorization. CVSS score: 8.8/10. Published 2020-09-16.
How severe is CVE-2020-14306?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2020-14306 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.