title: Incorrect Authorization with specially crafted requests
description: Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
problem types: CWE-285: Improper Authorization
affected:
{
vendor: pomerium
product: pomerium
versions:
version: >= 0.22.0, < 0.22.2, status: affected
version: >= 0.21.0, < 0.21.4, status: affected
version: >= 0.20.0, < 0.20.1, status: affected
version: >= 0.19.0, < 0.19.2, status: affected
version: >= 0.18.0, < 0.18.1, status: affected
version: < 0.17.4, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
]