CVE-2024-45808CWE-117

Malicious log injection via access logs in envoy

Medium · published September 19, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
27.5
In the wild
Unconfirmed
What it is

Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the `REQUESTED_SERVER_NAME` field for access loggers. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00351 · 27.5th percentile
Weakness
CWE-117 · Improper Output Neutralization for Logs
Published
2024-09-19T23:34Z
EPSS history
Timeline
  • 19 SEP 23:34Z
    Malicious log injection via access logs in envoy
    cvelistv5