Riskcovery

CVE-2022-1561

Crafted backend URLs in Lura Project

State
Published
Severity
4.0 Medium
Published
Aug 1, 2022
Updated
Sep 17, 2024
Reserved
May 3, 2022

Read the record on cve.org

Description

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.

Scores

CVSSScoreVectorSource
3.14.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:NINCIBE

Weaknesses

  • CWE-471 Modification of Assumed-Immutable Data

Affected Products

ProductVersions
Lura ProjectKrakenD
  • v2.0.2 to before v2.0.2Affected
KrakenD-CEKrakenD
  • v2.0.2 to before v2.0.2Affected
KrakenD-EEKrakenD
  • v2.0.0 to before v2.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.