Vulnerabilities > CVE-2022-39388 - Incorrect Authorization vulnerability in Istio 1.15.0/1.15.1
Attack vector
ADJACENT_NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
NONE Integrity impact
LOW Availability impact
NONE Summary
Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 5 |