CVE Feed

    Dashboard / CVE / CVE-2023-33189

    CVE-2023-33189

    Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.

    Published:May 30, 2023
    Last Modified:Jan 10, 2025
    EPS:May 30, 2023
    EPSS Score:0.00196
    CVSS Score:10

    Affected Products

    Vendor
    Pomerium
    Product
    Pomerium

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-285 Improper Authorization

    Related CVEs

    CVE-2024-47616 (CVSS 6.8) — Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for man…
    CVE-2024-39315 (CVSS 5.7) — Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (…
    CVE-2022-24797 (CVSS 6.5) — Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service expos…
    CVE-2021-41230 (CVSS 5.3) — Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a u…
    CVE-2021-39206 (CVSS 8.6) — Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two author…
    CVE-2021-39204 (CVSS 7.5) — Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles…
    CVE-2021-39162 (CVSS 8.6) — Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally term…
    CVE-2021-29652 (CVSS 6.1) — Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process…
    CVE-2021-29651 (CVSS 6.1) — Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).…

    References

    https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb
    https://github.com/pomerium/pomerium/releases/tag/v0.17.4
    https://github.com/pomerium/pomerium/releases/tag/v0.18.1
    https://github.com/pomerium/pomerium/releases/tag/v0.19.2
    https://github.com/pomerium/pomerium/releases/tag/v0.20.1
    https://github.com/pomerium/pomerium/releases/tag/v0.21.4
    https://github.com/pomerium/pomerium/releases/tag/v0.22.2
    https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p
    https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb
    https://github.com/pomerium/pomerium/releases/tag/v0.17.4
    https://github.com/pomerium/pomerium/releases/tag/v0.18.1
    https://github.com/pomerium/pomerium/releases/tag/v0.19.2
    https://github.com/pomerium/pomerium/releases/tag/v0.20.1
    https://github.com/pomerium/pomerium/releases/tag/v0.21.4
    https://github.com/pomerium/pomerium/releases/tag/v0.22.2
    https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High