CVE-2021-22113

Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive…

published February 23, 2021

CVSS
—
EPSS
1%
Percentile
57.8
In the wild
Unconfirmed
What it is

Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall (enabled by default for all URLs) are not affected by the vulnerability, as they reject requests that allow bypassing.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00852 · 57.8th percentile
Published
2021-02-23T16:04Z
EPSS history
Timeline
  • 23 FEB 16:04Z
    Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive…
    cvelistv5