CVE-2022-0484 HIGH

CVE-2022-0484: Improper URL Validation causes Mirantis Container Cloud Lens Extension to open external programs

Vendor Mirantis
Product Mirantis Container Cloud Lens Extension
Weakness CWE-20 · Input validation
Published February 4, 2022
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster. An attacker could host a webserver which serves a malicious Mirantis Container Cloud configuration file and induce the victim to add a new cluster via its URL. This issue affects: Mirantis Mirantis Container Cloud Lens Extension v3 versions prior to v3.1.1.

Key dates

02Disclosure timeline

February 4, 2022 CVE published
September 16, 2024 Record updated