Log in Start free

Vulnerability · Published May 30, 2023 · Assigned by GitHub_M

CVE-2023-33189Incorrect Authorization with specially crafted requests

Critical 10.0

In plain English

A critical-severity security flaw in pomerium from pomerium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.9%top 39.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/pomerium/pomerium0.22.2GHSA-pvrc-wvj2-f59p
Gogithub.com/pomerium/pomerium0.21.4GHSA-pvrc-wvj2-f59p
Gogithub.com/pomerium/pomerium0.20.1GHSA-pvrc-wvj2-f59p
Gogithub.com/pomerium/pomerium0.19.2GHSA-pvrc-wvj2-f59p
Gogithub.com/pomerium/pomerium0.18.1GHSA-pvrc-wvj2-f59p
Gogithub.com/pomerium/pomerium0.17.4GHSA-pvrc-wvj2-f59p
Gogithub.com/pomerium/pomerium0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4, 0.22.2GO-2023-1800

Affected products (as reported)

VendorProductVersions
pomerium pomerium >= 0.22.0, < 0.22.2>= 0.21.0, < 0.21.4>= 0.20.0, < 0.20.1>= 0.19.0, < 0.19.2>= 0.18.0, < 0.18.1< 0.17.4

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

References