4.3

CVE-2022-1561

Crafted backend URLs in Lura Project

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Krakend ≫ Krakend SwEditionenterprise Version < 2.0.0
Krakend ≫ Krakend SwEditioncommunity Version <= 2.0.2
Luraproject ≫ Lura Version < 2.0.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.49% 0.38
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
cve-coordination@incibe.es 4 2.2 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
CWE-471 Modification of Assumed-Immutable Data (MAID)

The product does not properly protect an assumed-immutable element from being modified by an attacker.

https://www.incibe-cert.es/en/early-warning/security-advisories/crafted-backend-urls-lura-project
Third Party Advisory
https://www.krakend.io/blog/cve-2022-1561-crafted-backend-urls/
Vendor Advisory