Critical severity · published May 30, 2023
CVE-2023-33189
Incorrect Authorization with specially crafted requests
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
pomerium · pomerium
>= 0.22.0, < 0.22.2; >= 0.21.0, < 0.21.4; >= 0.20.0, < 0.20.1; >= 0.19.0, < 0.19.2; >= 0.18.0, < 0.18.1; < 0.17.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-33189
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-33189
Patch
https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb
Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.17.4
Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.18.1
Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.19.2
Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.20.1
Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.21.4
More from pomerium
9.1
CVE-2022-24797
Exposure of Sensitive Information in Pomerium
8.8
CVE-2021-41230
OIDC claims not updated from Identity Provider in Pomerium
8.6
CVE-2021-39206
Incorrect Authorization with specially crafted requests
8.6
CVE-2021-39162
Incorrect handling of H2 GOAWAY + SETTINGS frames
7.5
CVE-2026-50285
Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback