CVE-2022-24797mediumCWE-200

CVE-2022-24797: falha de média gravidade em pomerium

Exposure of Sensitive Information in Pomerium

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar pomerium+ Monitorar github.com/pomerium/pomerium

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 1.4%
Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Produtos afetados
pomerium · pomerium
CVEs relacionadas — pomerium

No mesmo produto, das mais perigosas para as menos.

CVE-2021-39204HIGHExcessive CPU usage in PomeriumEPSS 1.7%CVE-2021-39162HIGHIncorrect handling of H2 GOAWAY + SETTINGS framesEPSS 1.6%CVE-2021-39206HIGHIncorrect Authorization with specially crafted requestsEPSS 1.5%CVE-2023-33189CRITICALIncorrect Authorization with specially crafted requestsEPSS 0.9%CVE-2021-41230MEDIUMOIDC claims not updated from Identity Provider in PomeriumEPSS 0.9%CVE-2026-50285HIGHPomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE CallbackEPSS 0.7%