CVE-2022-3962
Kiali: error message spoofing in kiali ui
A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Kiali: error message spoofing in kiali ui
A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
- Record
CVE-2022-3962- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2023-2443
A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
- Record
EUVD-2023-2443- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6f4m-j56w-55c3
Kiali content spoofing vulnerability
A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
- Record
GHSA-6f4m-j56w-55c3- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
NVD
A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
- Record
CVE-2022-3962- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVGHSA-6f4m-j56w-55c3
Kiali content spoofing vulnerability
A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
- Record
GHSA-6f4m-j56w-55c3- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVGO-2023-2075 No score
Kiali content spoofing vulnerability in github.com/kiali/kiali
Kiali content spoofing vulnerability in github.com/kiali/kiali
- Record
GO-2023-2075- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/kiali/kialiGo |
before 1.57.4 | 1.57.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-3962 is a medium vulnerability (CVSS 4.3) in Kiali, published September 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in github.com/kiali/kiali 1.57.4.
References
access.redhat.com/errata/RHSA-2023:0542
bugzilla.redhat.com/show_bug.cgi?id=2148661
nvd.nist.gov/vuln/detail/CVE-2022-3962
github.com/kiali/kiali/commit/aab7694f850f04d7fd875fac5f720a93ccdf01ad
issues.redhat.com/browse/OSSM-2251?attachmentViewMode=list