Executive brief
Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium
Affected products
- Go github.com/pomerium/pomerium
Junglewise Threat Intelligence
CVE-2023-33189: GO-2023-1800 - Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium
CVE-2023-33189 · Severity: low · CVSS 3.1 · Published 2024-08-20
Technologies: github.com/pomerium/pomerium (Go). Vendors: Go.
Related threats
- Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression
- GO-2024-3179 - Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium
- GO-2022-0933 - Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium
- GO-2022-0827 - pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
- GO-2022-0783 - JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium