CVE-2022-24797 json
Exposure of Sensitive Information in Pomerium
published 2022-03-31 4 y ago modified 2026-06-17 4 mo ago also GHSA-q98f-2x4p-prjr , GO-2022-0413 , EUVD-2024-2854
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 0
- none known
Summary
Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.
Patch / fix
- go github.com/pomerium/pomerium 0.17.1
- pomerium pomerium 0.17.1
- github.com/pomerium/pomerium@b435f73 commit
- github.com/pomerium/pomerium#3212 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
1.38% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:N/A:P |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/pomerium/pomerium | >=0.16.0, <0.17.1 |
0.17.1 |
Affected products
- pomerium pomerium
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/pomerium/pomerium/pull/3212
web, issue-tracking, patch, third-party-advisory
-
github.com
/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903
web, patch, third-party-advisory
-
github.com
/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr
web, mitigation, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-24797
advisory
-
github.com
/pomerium/pomerium
package
-
pkg.go.dev
/vuln/GO-2022-0413
web
Sources
- CVE List CVE-2022-24797
- GitHub Advisory GHSA-q98f-2x4p-prjr
- NVD CVE-2022-24797
- OSV GO-2022-0413
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.