PT-2024-31788 · Envoy · Envoy

Howardjohn · Published 2024-09-19 · Updated 2026-01-06 · CVE-2024-45808

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.28.7 Envoy versions prior to 1.29.9 Envoy versions prior to 1.30.6 Envoy versions prior to 1.31.2

Description: A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the REQUESTED SERVER NAME field for access loggers.

Recommendations: For versions prior to 1.28.7, upgrade to version 1.28.7 or later. For versions prior to 1.29.9, upgrade to version 1.29.9 or later. For versions prior to 1.30.6, upgrade to version 1.30.6 or later. For versions prior to 1.31.2, upgrade to version 1.31.2 or later.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

CWE-117

Related Identifiers

BIT-ENVOY-2024-45808

CVE-2024-45808

GHSA-P222-XHP9-39RC

Affected Products

Envoy

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45808.json · Exploit
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-p222-xhp9-39rc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45808 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45808 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-envoy-2024-45808 · Vendor Advisory
• https://t.me/cvedetector/6096 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1837045901111496939 · Twitter Post
• https://twitter.com/CVEnew/status/1836913415400386757 · Twitter Post
• https://twitter.com/Vu1nAlert/status/1837061476625822127 · Twitter Post
• https://twitter.com/dailycve/status/2008332584401391646 · Twitter Post