Incorrect Authorization with specially crafted requests
CVE-2023-33189
9.8CRITICAL
What is CVE-2023-33189?
An authorization flaw exists in Pomerium, an identity and context-aware access proxy, that could allow maliciously crafted requests to bypass intended security controls leading to incorrect authorization decisions. This vulnerability emphasizes the need for user awareness and prompt updating to the latest versions, which are patched to mitigate this issue. Users are urged to upgrade to versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4, or 0.22.2 to ensure their systems remain secure.
Affected Version(s)
pomerium >= 0.22.0, < 0.22.2 < 0.22.0, 0.22.2
pomerium >= 0.21.0, < 0.21.4 < 0.21.0, 0.21.4
pomerium >= 0.20.0, < 0.20.1 < 0.20.0, 0.20.1