CVE-2023-33189: pomerium

csirt@kutim:~/threat-intel/cve/CVE-2023-33189

CVSS 9.8 · Critical EPSS 0,92%

Kerentanan Improper Authorization pada pomerium. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.

Rincian

Terbit di NVD: 30 Mei 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-285: Improper Authorization
EPSS (30 hari): 0,92% peluang dieksploitasi; lebih tinggi dari 59,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
pomerium	pomerium	Semua versi sebelum 0.17.4
pomerium	pomerium	Versi 0.19.0 hingga sebelum 0.19.2
pomerium	pomerium	Versi 0.21.0 hingga sebelum 0.21.4
pomerium	pomerium	Versi 0.22.0 hingga sebelum 0.22.2
pomerium	pomerium	Versi 0.18.0
pomerium	pomerium	Versi 0.20.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p advisory vendor
https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb patch
https://github.com/pomerium/pomerium/releases/tag/v0.17.4 release notes
https://github.com/pomerium/pomerium/releases/tag/v0.18.1 release notes
https://github.com/pomerium/pomerium/releases/tag/v0.19.2 release notes
https://github.com/pomerium/pomerium/releases/tag/v0.20.1 release notes
https://github.com/pomerium/pomerium/releases/tag/v0.21.4 release notes
https://github.com/pomerium/pomerium/releases/tag/v0.22.2 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.