Description (CNA)
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Kong Inc. / Kong Mesh | affected 0 before 2.7.25; affected 2.8.0 before 2.9.15; affected 2.10.0 before 2.11.13; affected 2.12.0 before 2.12.10; affected 2.13.0 before 2.13.5 |
CWE
CWE-346, CWE-942
References
- https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2
- https://github.com/kumahq/kuma/pull/16416
- https://github.com/kumahq/kuma/pull/16423
- https://github.com/kumahq/kuma/pull/16424
- https://github.com/kumahq/kuma/pull/16425
- https://github.com/kumahq/kuma/pull/16426
- https://github.com/kumahq/kuma/pull/16427
- https://developer.konghq.com/mesh/changelog/
ADP enrichment
No English description supplied.
No references supplied.