Executive brief
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium
Affected products
- Go github.com/pomerium/pomerium
Junglewise Threat Intelligence
CVE-2024-39315: GO-2024-2965 - Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium
CVE-2024-39315 · Severity: low · CVSS 3.1 · Published 2024-07-03
Technologies: github.com/pomerium/pomerium (Go). Vendors: Go.
Related threats
- Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression
- GO-2024-3179 - Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium
- GO-2022-0933 - Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium
- GO-2022-0827 - pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
- GO-2022-0783 - JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium