CVE-2024-52003
Last modified
CVE-2024-52003 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Traefik | Traefik | < 2.11.14 |
| Traefik | Traefik | >= 3.0.0, < 3.2.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-52003?
How severe is CVE-2024-52003?
How do I fix CVE-2024-52003?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-51998changedetection.io is a free open source web page change det…8.6
- CVE-2024-51999Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2024-5200The Postie WordPress plugin before 1.9.71 does not sanitise …4.8
- CVE-2024-52000Combodo iTop is a simple, web based IT Service Management to…6.1
- CVE-2024-52001Combodo iTop is a simple, web based IT Service Management to…4.3
- CVE-2024-52002Combodo iTop is a simple, web based IT Service Management to…8.8
- CVE-2024-52004MediaCMS is an open source video and media CMS, written in P…8.7
- CVE-2024-52005Git is a source code management tool. When cloning from a se…8.8
- CVE-2024-52006Git is a fast, scalable, distributed revision control system…7.5
- CVE-2024-52007HAPI FHIR is a complete implementation of the HL7 FHIR stand…8.6
- CVE-2024-52008Fides is an open-source privacy engineering platform. The us…8.8
- CVE-2024-52009Atlantis is a self-hosted golang application that listens fo…9.8
Are you affected by CVE-2024-52003?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST