1206 matches found
CVE-2020-15129
In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path an...
CVE-2020-15129
In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path an...
CVE-2020-15129
In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path an...
Open redirect
In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path an...
CVE-2020-15129 Open redirect in Traefik
In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path an...
CVE-2020-15129
CVE-2020-15129 — Traefik open redirect affects Traefik pre-1.7.26, 2.2.8, and 2.3.0-rc3. The root cause is that the API dashboard’s handling of the X-Forwarded-Prefix header does not validate that the value is a site-relative path, allowing redirects to arbitrary URIs. Impact per sources: an atta...
CVE-2020-15129
In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path an...
Man-in-the-middle (MitM)
github.com/containous/traefik is vulnerable to man-in-the-middle attack. It does not establish a mutual TLS verification for HTTPS sessions when the error ERRBADSSLCLIENTAUTHCERT occurs...
Containous Traefik Trust Management Issues Vulnerability (CNVD-2021-18240)
Containous Traefik is a reverse proxy and load balancer from Containous USA. A vulnerability in Containous Traefik version 2.x exists due to a trust management issue. The vulnerability stems from the lack of an effective trust management mechanism in a networked system or product. An attacker can...
CVE-2019-20894
Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...
CVE-2019-20894
Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...
Design/Logic Flaw
Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...
CVE-2019-20894
Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...
CVE-2019-20894
CVE-2019-20894 : Traefik 2.x can allow HTTPS sessions to proceed without mutual TLS verification in certain configurations, where an ERR_BAD_SSL_CLIENT_AUTH_CERT would be expected. This describes a gap in mutual TLS authentication that could expose confidentiality to a man-in-the-middle. The prov...
PT-2020-10858 · Containous · Traefik
Name of the Vulnerable Software and Affected Versions: Traefik versions 2.x Description: The issue allows HTTPS sessions to proceed without mutual TLS verification in certain configurations, where an error should have occurred due to a bad SSL client authentication certificate. This situation can...
Authelia - The Single Sign-On Multi-Factor Portal For Web Apps
Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on SSO for your applications via a web portal. It acts as a companion of reverse proxies like nginx, Traefik or HAProxy to let them know whether queries should pass through...
Containous Traefik Trust Management Issues Vulnerability
Containous Traefik is a reverse proxy and load balancer from Containous USA. A trust management issue vulnerability exists in Containous Traefik version 2.x prior to 2.1.4 and TraefikEE version 2.0.0. The vulnerability stems from the lack of an effective trust management mechanism in a networked...
Information Disclosure
github.com/containous/traefik is vulnerable to information disclosure. The attack is possible because the function preLoadConfiguration is not properly removing the certificate contents from providers before logging...