CVE-2021-39206CWE-863

Incorrect Authorization with specially crafted requests

High · published September 9, 2021

CVSS v3.1
8.6
EPSS
1%
Percentile
73.3
In the wild
Unconfirmed
What it is

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01457 · 73.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2021-09-09T22:10Z
EPSS history
Timeline
  • 09 SEP 22:10Z
    Incorrect Authorization with specially crafted requests
    cvelistv5