~ / search / GHSA-vwpg-f6gw-rjvf

GHSA-vwpg-f6gw-rjvf

Incorrect Authorization in Spring Cloud Netflix Zuul

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-22113

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework.cloud:spring-cloud-netflix-zuul < 2.2.7 2.2.7

Details

As written in the advisory (Markdown source, shown as plain text).

Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall (enabled by default for all URLs) are not affected by the vulnerability, as they reject requests that allow bypassing.

References

External links from the advisory. They lead to third-party sites.