GitHub Advisoryadvisory · Maven

GHSA-vwpg-f6gw-rjvf Incorrect Authorization in Spring Cloud Netflix Zuul

MEDIUM Published 2021-05-10 Modified 2021-05-07 Official page ↗
Aliases
CVE-2021-22113
Ecosystem
Maven
Packages
org.springframework.cloud:spring-cloud-netflix-zuul
Severity
Moderate
Weaknesses
CWE-863
Reviewed
2021-05-07

Affected packages

• Maven org.springframework.cloud:spring-cloud-netflix-zuul: < 2.2.7 → fixed in 2.2.7

Description

Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall (enabled by default for all URLs) are not affected by the vulnerability, as they reject requests that allow bypassing.

Related

Alias · CVE (1)

  • CVE-2021-22113 Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References