PT-2023-24206 · Pomerium · Pomerium

Nonsleepr · Publicado 2023-05-26 · Atualizado 2024-08-20 · CVE-2023-33189

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pomerium versions prior to 0.17.4 Pomerium versions prior to 0.18.1 Pomerium versions prior to 0.19.2 Pomerium versions prior to 0.20.1 Pomerium versions prior to 0.21.4 Pomerium versions prior to 0.22.2

Description Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium.

Recommendations Upgrade to version 0.17.4 or later. Upgrade to version 0.18.1 or later. Upgrade to version 0.19.2 or later. Upgrade to version 0.20.1 or later. Upgrade to version 0.21.4 or later. Upgrade to version 0.22.2 or later.

Exploit

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2023-33189

GHSA-PVRC-WVJ2-F59P

GO-2023-1800

Produtos afetados

Pomerium

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33189.json · Exploit
• https://github.com/pomerium/pomerium/releases/tag/v0.18.1 · Nota
• https://github.com/pomerium/pomerium/releases/tag/v0.20.1 · Nota
• https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p · Aviso do Fabricante
• https://github.com/pomerium/pomerium/releases/tag/v0.17.4 · Nota
• https://github.com/pomerium/pomerium/releases/tag/v0.22.2 · Nota
• https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb · Correção
• https://github.com/pomerium/pomerium/releases/tag/v0.19.2 · Nota
• https://github.com/pomerium/pomerium/releases/tag/v0.21.4 · Nota
• https://github.com/pomerium/pomerium · Nota
• https://osv.dev/vulnerability/GHSA-pvrc-wvj2-f59p · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-33189 · Nota de Segurança
• https://osv.dev/vulnerability/GO-2023-1800 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-33189 · Aviso do Fabricante
• https://t.me/cvenotify/51349 · Publicação no Telegram