CVE-2022-0484 - CVE House
Back to Database
Status published High CVE-2022-0484

Improper URL Validation causes Mirantis Container Cloud Lens Extension to open external programs

Vulnerability Description

Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster. An attacker could host a webserver which serves a malicious Mirantis Container Cloud configuration file and induce the victim to add a new cluster via its URL. This issue affects: Mirantis Mirantis Container Cloud Lens Extension v3 versions prior to v3.1.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-0484

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Mirantis PSIRT

References

More from Mirantis

View All →
CVE-2022-0270
Improper header sanitization in bored-agent causes escalation of privilege
High 8.8
CVE-2021-44458
Lack of websocket authentication in Lens causes remote code execution when visiting a malicious website
High 8.3
CVE-2021-23218
Memory Leak in Mirantis Container Runtime (MCR) running in FIPS mode causes a Denial of Service
Medium 5.3
CVE-2021-23154
Command injection in Lens causes arbitrary shell command execution when malicious custom helm chart configuration provided
Medium 6.3

Affected Vendor

Affected Software

Mirantis Container Cloud Lens Extension
Vulnerable Versions:
v3

Timeline

Official Publish: February 4th, 2022
Last Modified: September 16th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact