by Kastro
Paper/Archive/CVE-2023-33189

CVE-2023-33189

pomerium pomerium — Incorrect Authorization with specially crafted requests

EPSS 0.9%CVSS 10.0
critical.is priorityof 100
42
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 60.3.603 × 2012.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.

Affected

ProductAffectedFixed inSource
pomerium>= 0.22.0, < 0.22.2–CNA
pomerium>= 0.21.0, < 0.21.4–CNA
pomerium>= 0.20.0, < 0.20.1–CNA
pomerium>= 0.19.0, < 0.19.2–CNA
pomerium>= 0.18.0, < 0.18.1–CNA
pomerium< 0.17.4–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59prefgithub.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebbrefgithub.com/pomerium/pomerium/releases/tag/v0.17.4refgithub.com/pomerium/pomerium/releases/tag/v0.18.1refgithub.com/pomerium/pomerium/releases/tag/v0.19.2refgithub.com/pomerium/pomerium/releases/tag/v0.20.1refgithub.com/pomerium/pomerium/releases/tag/v0.21.4refgithub.com/pomerium/pomerium/releases/tag/v0.22.2