Security Bypass

2024-08-1609:13:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

security bypass

implementation

gateway api

httproutes

grpcroutes

request headers

request methods

attacker

unexpected behavior

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

AI Score

6.6

Confidence

High

JSON

github.com/cilium/cilium is vulnerable to Security Bypass. The vulnerability is due to improper implementation of match precedence in Gateway API HTTPRoutes and GRPCRoutes, where request headers are matched before request methods. It allows an attacker to exploit the incorrect request handling order to potentially cause unexpected behavior or security issues.