CVE-2020-15129

Severity CVSS v4.0:

Pending analysis

Type:

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Publication date:

30/07/2020

Last modified:

28/07/2021

Description

In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik&#39;s handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn&#39;t validate that the value of the header "X-Forwarded-Prefix" is a site relative path and will redirect to any header provided URI. Successful exploitation of an open redirect can be used to entice victims to disclose sensitive information. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS v3.1 Severity and Metrics:

Base Score: 4.70 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope (S): Changed
Confidentiality (C): Low
Integrity (I): Low
Availability (A): None

Base Score 3.x

4.70

Severity 3.x

MEDIUM

Vector 2.0

AV:N/AC:H/Au:N/C:P/I:P/A:N CVSS v2.0 Severity and Metrics:

Base Score: 4.00 MEDIUM
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N

Attack Vector (AV): Network
Attack Complexity (AC): High
Authentication (Au): None
Confidentiality (C): Physical
Integrity (I): Physical
Availability (A): None

Base Score 2.0

4.00

Severity 2.0

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:traefik:traefik::::::::		1.7.26 (excluding)
cpe:2.3:a:traefik:traefik::::::::	2.2.0 (including)	2.2.8 (excluding)
cpe:2.3:a:traefik:traefik:2.3.0:-::::::
cpe:2.3:a:traefik:traefik:2.3.0:rc1::::::
cpe:2.3:a:traefik:traefik:2.3.0:rc2::::::

To consult the complete list of CPE names with products and versions, see this page

CVE-2020-15129

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools