CVE-2022-0484

Improper URL Validation causes Mirantis Container Cloud Lens Extension to open external programs

State: Published
Severity: 8.8 High
Published: Feb 4, 2022
Updated: Sep 16, 2024
Reserved: Feb 3, 2022

Description

Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster. An attacker could host a webserver which serves a malicious Mirantis Container Cloud configuration file and induce the victim to add a new cluster via its URL. This issue affects: Mirantis Mirantis Container Cloud Lens Extension v3 versions prior to v3.1.1.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Mirantis

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
Mirantis Container Cloud Lens ExtensionMirantis	v3 to before v3.1.1Affected

References

https://github.com/Mirantis/security/blob/main/advisories/0005.md

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.