Information disclosure in Traefik
CVE-2022-23469
Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Authorization header in its debug logs. In certain cases, if the log level is set to DEBUG, credentials provided using the Authorization header are displayed in the debug logs. Attackers must have access to a users logging system in order for credentials to be stolen. This issue has been addressed in version 2.9.6. Users are advised to upgrade. Users unable to upgrade may set the log level to `INFO`, `WARN`, or `ERROR`.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.010 (61.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 62nd percentile — 61.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: +0.000
Affected products
- Traefik — versions < 2.9.6
Weakness classification (CWE)
References
- github.com/traefik/traefik/security/advisories/GHSA-h2ph-vhm7-g4hp (Exploit, Patch, Third Party Advisory)
- github.com/traefik/traefik/pull/9574 (Patch, Third Party Advisory)
- github.com/traefik/traefik/releases/tag/v2.9.6 (Third Party Advisory, Release Notes)
Frequently asked questions
- What is CVE-2022-23469?
- CVE-2022-23469 is a low-severity vulnerability in Traefik, classified under Information Disclosure. CVSS score: 3.5/10. Published 2022-12-08.
- How severe is CVE-2022-23469?
- Low severity. CVSS v3 base score is 3.5 out of 10.