Executive brief
Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium
Affected products
- Go github.com/pomerium/pomerium
Junglewise Threat Intelligence
CVE-2024-47616: GO-2024-3179 - Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium
CVE-2024-47616 · Severity: low · CVSS 3.1 · Published 2024-10-09
Technologies: github.com/pomerium/pomerium (Go). Vendors: Go.
Related threats
- Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression
- GO-2022-0933 - Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium
- GO-2022-0827 - pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
- GO-2022-0783 - JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium
- GO-2022-0413 - Exposure of Sensitive Information in Pomerium in github.com/pomerium/pomerium