Description
A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to internal-only services or arbitrary external systems. This is a regression of the fix for CVE-2023-27487.
Remediation
References
Related Vulnerabilities
WordPress Plugin Easy Cookies Policy Cross-Site Scripting (1.6.2)
XWiki Improper Authentication Vulnerability (CVE-2022-36093)
WordPress Plugin WP-Members Membership Cross-Site Scripting (3.1.4.2)
WordPress Plugin Modula Image Gallery Cross-Site Scripting (2.2.4)
WordPress Plugin AgentEasy Properties Cross-Site Scripting (1.0.4)