What is CVE-2022-23469?

CVE-2022-23469 is a low-severity vulnerability in Traefik, classified under Information Disclosure. CVSS score: 3.5/10. Published 2022-12-08.

How severe is CVE-2022-23469?

Low severity. CVSS v3 base score is 3.5 out of 10.

Information disclosure in Traefik

CVE-2022-23469

Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Authorization header in its debug logs. In certain cases, if the log level is set to DEBUG, credentials provided using the Authorization header are displayed in the debug logs. Attackers must have access to a users logging system in order for credentials to be stolen. This issue has been addressed in version 2.9.6. Users are advised to upgrade. Users unable to upgrade may set the log level to `INFO`, `WARN`, or `ERROR`.

Vulnerability class: Information Disclosure

EPSS: 0.010 (58.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N.

Affected products

Traefik — versions < 2.9.6

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Patch, Third Party Advisory)
security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2022-23469?: CVE-2022-23469 is a low-severity vulnerability in Traefik, classified under Information Disclosure. CVSS score: 3.5/10. Published 2022-12-08.
How severe is CVE-2022-23469?: Low severity. CVSS v3 base score is 3.5 out of 10.