Описание
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
Ссылки
- ProductRelease Notes
- ProductRelease Notes
- ProductRelease Notes
- ExploitPatchVendor Advisory
Уязвимые конфигурации
Одно из
EPSS
10 Critical
CVSS3
8.2 High
CVSS3
Дефекты
Связанные уязвимости
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
Traefik is an HTTP reverse proxy and load balancer. Prior to versions ...
Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication
Уязвимость промежуточного программного обеспечения ForwardAuth обратного прокси сервера Containous Traefik, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
10 Critical
CVSS3
8.2 High
CVSS3