Mirantis: CVE Program partner

CVEs, 365 days05 all time, 0 rejected

Quality-median 99%

CVSS by the CNA-share of records

CWE-share of records

Affected versions-not n/a or unspecified

CVSS added by CISA-lower is better

Organisation	Mirantis
Role	CNA
Type	Vendor, Open Source, Researcher
Reports to	mitre
Scope	All Mirantis products (supported products and end-of-life/end-of-service products) and open source offerings, as well as vulnerabilities in third-party software discovered by Mirantis that are not in another CNA’s scope.
Advisories	https://github.com/Mirantis/security/blob/main/advisories/advisories.md

CVE-2022-0484 2022-02-04 · CVSS 8.8
Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign
CVE-2022-0270 2022-01-25 · CVSS 8.8
Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.
CVE-2021-23154 2022-01-10 · CVSS 6.3
In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the use
CVE-2021-23218 2022-01-10 · CVSS 5.3
When running with FIPS mode enabled, Mirantis Container Runtime 20.10.8 leaks memory during TLS Handshakes which could be abused to cause a denial of service.
CVE-2021-44458 2022-01-10 · CVSS 8.3
Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from the

Mirantis