VulnerabilityAnalyzed

CVE-2024-52003

There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source.

MEDIUM 6.3EPSS 0.40%

Does this matter?

Lower severity and a low EPSS score (0.40%). Track it; it rarely justifies an emergency change on its own.

Description

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 4.0: 6.3 MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.40% probability · 34th percentile
CISA KEV: Not listed
Weakness: CWE-601
Affected: traefik/traefik
Source: security-advisories@github.com

References

https://github.com/traefik/traefik/pull/11253Patch
https://github.com/traefik/traefik/releases/tag/v2.11.14Release Notes
https://github.com/traefik/traefik/releases/tag/v3.2.1Release Notes
https://github.com/traefik/traefik/security/advisories/GHSA-h924-8g65-j9wgPatch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.