UpHeron
All vulnerabilities

Servers and applications

CVE-2020-15129

X-Forwarded-Prefix Header Validation Vulnerability

Severity
Medium 4.7
Published
30 Jul 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.7.26, 2.2.8, 2.3.0-rc3
Also known as
GHSA-6qq8-5wq3-86rp
Sources
NVD, Project advisories (GitHub)

Description

In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path and will redirect to any header provided URI. Successful exploitation of an open redirect can be used…

Affected software

SoftwareAffected versions
TraefikServers and applications · cpe:a:traefik:traefik
  • Every version before 1.7.26
  • From 2.2.0 before 2.2.8
  • Version 2.3.0-rc1
  • Version 2.3.0-rc2
  • Version 2.3.0
TraefikServers and applications · github:traefik/traefik
  • Every version before 2.2.8
  • Every version before 1.7.26
  • From 2.3.0-rc1 before 2.3.0-rc3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15129
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-15129
  • GitHub Advisory Database https://github.com/advisories/GHSA-6qq8-5wq3-86rp
  • github.com https://github.com/traefik/traefik/security/advisories/GHSA-6qq8-5wq3-86rp