How severe is CVE-2022-3962?

CVE-2022-3962 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2022-3962 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-3962?

CVE-2022-3962 primarily affects Redhat Openshift Service Mesh. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-3962?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-3962 published?

CVE-2022-3962 was published on 2023-09-23 and last updated on 2026-06-17.

CVE-2022-3962

CVE-2022-3962 is a medium-severity vulnerability in Redhat Openshift Service Mesh with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-74.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 1% (49th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-74
Affected product: Redhat Openshift Service Mesh
Published: 2023-09-23
Last modified: 2026-06-17

Description

A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.

Frequently asked questions

What is CVE-2022-3962?: A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
How severe is CVE-2022-3962?: CVE-2022-3962 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2022-3962 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-3962?: CVE-2022-3962 primarily affects Redhat Openshift Service Mesh. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-3962?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-3962 published?: CVE-2022-3962 was published on 2023-09-23 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:kiali:kiali:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:2.3.1:*:*:*:*:*:*:*

More vulnerabilities in Redhat Openshift Service Mesh

CVE-2021-3586 — Critical (CVSS 9.8): A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify…
CVE-2020-27846 — Critical (CVSS 9.8): A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML…
CVE-2021-3495 — High (CVSS 8.8): An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw…
CVE-2020-1764 — High (CVSS 8.6): A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior…
CVE-2019-9900 — High (CVSS 8.3): When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0).…
CVE-2026-47774 — High (CVSS 7.5): Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11,…

All CVEs affecting Redhat Openshift Service Mesh →

Other CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities

CVE-2026-25586 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty…
CVE-2026-25520 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped.…
CVE-2025-20265 — Critical (CVSS 10.0): A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could…
CVE-2025-20337 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
CVE-2025-20281 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
CVE-2024-42472 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious…

Browse all CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities →