CVE-2019-9901

Envoy 1.9.0 and before does not normalize HTTP URL paths

Medium · published April 25, 2019

CVSS v3.0
6.5
EPSS
5%
Percentile
92.1
In the wild
Unconfirmed
What it is

Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AC:H/AV:N/A:L/C:L/I:L/PR:N/S:C/UI:N
CVSS v4.0
Not supplied
EPSS
0.04951 · 92.1th percentile
Published
2019-04-25T15:31Z
EPSS history
Timeline
  • 25 APR 15:31Z
    Envoy 1.9.0 and before does not normalize HTTP URL paths
    cvelistv5