CVEvulnerability

CVE-2023-33189

9.8 CRITICAL Published 2023-05-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-05-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-285

Description

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.

Affected configurations

• pomerium pomerium (< 0.17.4) • pomerium pomerium (>= 0.19.0 < 0.19.2) • pomerium pomerium (>= 0.21.0 < 0.21.4) • pomerium pomerium (>= 0.22.0 < 0.22.2) • pomerium pomerium 0.18.0 • pomerium pomerium 0.20.0

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References