Exposição de Envoy

Reverse proxies
69
score de exposição
90.631
sites usam
0
em exploração
1
críticos
Análise Vexday

Com 78 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o Envoy apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica ausência de exploração confirmada em campo até o momento. Ainda assim, o escore EPSS de 0,8781 associado a CVE-2024-30255 sinaliza probabilidade elevada de exploração futura, merecendo atenção prioritária nas equipes de resposta. O tipo de falha mais recorrente é CWE-416 (use-after-free), uma classe de vulnerabilidade com potencial de impacto severo em tempo de execução, especialmente em proxies de alto throughput como o Envoy. A presença de apenas uma CVE crítica e duas ocorrências nos últimos 90 dias sugere ritmo moderado de descobertas recentes, mas o perfil de risco não deve ser subestimado dado o valor EPSS observado.

CVEs

92 resultados
CVE-2024-30255MEDIUMHTTP/2: CPU exhaustion due to CONTINUATION frame floodEPSS 87.8%CVE-2024-27919HIGHHTTP/2: memory exhaustion due to CONTINUATION frame floodEPSS 86.7%CVE-2021-29492HIGHBypass of path matching rules using escaped slash charactersEPSS 68.4%CVE-2021-32777HIGHIncorrect concatenation of multiple value request headers in ext-authz extensionEPSS 3.3%CVE-2024-21879HIGHURL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225EPSS 2.5%CVE-2024-21880HIGHURL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.xEPSS 2.3%CVE-2021-21378HIGHJWT authentication bypass with unknown issuer tokenEPSS 1.7%CVE-2022-29225HIGHZip bomb vulnerability in EnvoyEPSS 1.5%CVE-2024-21878HIGHCommand Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.xEPSS 1.4%CVE-2021-32781HIGHContinued processing of requests after locally generated responseEPSS 1.3%CVE-2023-35945HIGHEnvoy vulnerable to HTTP/2 memory leak in nghttp2 codecEPSS 1.3%CVE-2022-29226CRITICALTrivial authentication bypass in EnvoyEPSS 1.3%CVE-2021-32780HIGHIncorrect handling of H/2 GOAWAY followed by SETTINGS framesEPSS 1.2%CVE-2021-32778MEDIUMExcessive CPU utilization when closing HTTP/2 streamsEPSS 1.2%CVE-2022-29228HIGHReachable assertion in EnvoyEPSS 1.2%CVE-2022-29227HIGHUse after free in EnvoyEPSS 1.2%CVE-2022-21655HIGHIncorrect handling of internal redirects results in crash in EnvoyEPSS 1.1%CVE-2023-33869MEDIUMEnphase Envoy OS Command InjectionEPSS 1.1%CVE-2022-21654HIGHIncorrect configuration handling allows TLS session re-use without re-validation in EnvoyEPSS 1.1%CVE-2021-43826HIGHCrash when tunneling TCP over HTTP in EnvoyEPSS 1.1%