CVE-2020-15129

Katalog CVE

CVSS 4.7 · Medium EPSS 8,0%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada traefik. Skor CVSS 3.1 4.7 (Medium) menurut NVD.

Deskripsi (NVD)

In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path and will redirect to any header provided URI. Successful exploitation of an open redirect can be used to entice victims to disclose sensitive information. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.

Rincian

Terbit di NVD

30 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.7 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

8,0% peluang dieksploitasi; lebih tinggi dari 94,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/containous/traefik/commit/e63db782c11c7b8bfce30be4c902e7ef8f9f33d2 patch · advisory pihak ketiga
• https://github.com/containous/traefik/pull/7109 patch · advisory pihak ketiga
• https://github.com/containous/traefik/releases/tag/v1.7.26 release notes · advisory pihak ketiga
• https://github.com/containous/traefik/releases/tag/v2.2.8 release notes · advisory pihak ketiga
• https://github.com/containous/traefik/releases/tag/v2.3.0-rc3 release notes · advisory pihak ketiga
• https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp advisory pihak ketiga