Critical severity · published May 30, 2023
CVE-2023-33189
Pomerium is an identity and context-aware access proxy
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Pomerium · Pomerium
before 0.17.4; 0.19.0 before 0.19.2; 0.21.0 before 0.21.4; 0.22.0 before 0.22.2; 0.18.0; 0.20.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-33189
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-33189
Patch
https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb
Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.17.4
Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.18.1
Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.19.2
Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.20.1
Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.21.4
More from Pomerium
9.1
CVE-2022-24797
Pomerium is an identity-aware access proxy
8.8
CVE-2021-41230
Pomerium is an open source identity-aware access proxy
8.6
CVE-2021-39206
Pomerium is an open source identity-aware access proxy
8.6
CVE-2021-39162
Pomerium is an open source identity-aware access proxy
7.5
CVE-2026-50285
Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback