Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:44575
HistoryDec 05, 2023 - 8:20 a.m.

Authorization Bypass

2023-12-0508:20:49
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
9
traefik
authorization bypass
url fragments
frontend proxies
nginx
access control

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

20.7%

github.com/traefik/traefik is vulnerable to Authorization Bypass. This vulnerability arises because Traefik automatically encodes and forwards URL fragments to backend servers, violating protocol standards and potentially bypassing security controls implemented by frontend proxies like NGINX. An attacker could exploit this flaw to bypass access control restrictions enforced by frontend proxies, potentially gaining unauthorized access to sensitive resources or functionalities.

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

20.7%