CVE-2020-15129 Open redirect in Traefik

In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path an...

CVE-2020-15129

CVE-2020-15129 — Traefik open redirect affects Traefik pre-1.7.26, 2.2.8, and 2.3.0-rc3. The root cause is that the API dashboard’s handling of the X-Forwarded-Prefix header does not validate that the value is a site-relative path, allowing redirects to arbitrary URIs. Impact per sources: an atta...