Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:44575
HistoryDec 05, 2023 - 8:20 a.m.

Authorization Bypass

2023-12-0508:20:49
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
13
traefik
authorization bypass
url fragments
frontend proxies
nginx
access control

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.7

Confidence

Low

EPSS

0.001

Percentile

20.6%

github.com/traefik/traefik is vulnerable to Authorization Bypass. This vulnerability arises because Traefik automatically encodes and forwards URL fragments to backend servers, violating protocol standards and potentially bypassing security controls implemented by frontend proxies like NGINX. An attacker could exploit this flaw to bypass access control restrictions enforced by frontend proxies, potentially gaining unauthorized access to sensitive resources or functionalities.

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.7

Confidence

Low

EPSS

0.001

Percentile

20.6%