Vulnerability Description
Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster. An attacker could host a webserver which serves a malicious Mirantis Container Cloud configuration file and induce the victim to add a new cluster via its URL. This issue affects: Mirantis Mirantis Container Cloud Lens Extension v3 versions prior to v3.1.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mirantis | Container Cloud Lens Extension | >= 3.0.0, < 3.1.1 |
Related Weaknesses (CWE)
References
- https://github.com/Mirantis/security/blob/main/advisories/0005.mdThird Party Advisory
- https://github.com/Mirantis/security/blob/main/advisories/0005.mdThird Party Advisory
FAQ
What is CVE-2022-0484?
CVE-2022-0484 is a vulnerability with a CVSS score of 8.8 (HIGH). Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster. An attacker could ...
How severe is CVE-2022-0484?
CVE-2022-0484 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-0484?
Check the references section above for vendor advisories and patch information. Affected products include: Mirantis Container Cloud Lens Extension.