CVE-2021-31920

ADVISORY - github

Summary

Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization policy when path based authorization rules are used.

EPSS Score⁠: 0.00191 (0.408)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-706⁠

Use of Incorrectly-Resolved Name or Reference

ADVISORY - github

CWE-863⁠

Incorrect Authorization

ADVISORY - gitlab

CWE-1035⁠

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

CWE-706⁠

Use of Incorrectly-Resolved Name or Reference

CWE-937⁠

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

ADVISORY - redhat

CWE-863⁠

Incorrect Authorization

Impacted images

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.