UpHeron
All vulnerabilities

Servers and applications

CVE-2024-52003

X-Forwarded-Prefix Header allows for Open Redirect

Severity
Medium 6.3
Published
29 Nov 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.11.14, 3.2.1
Also known as
GHSA-h924-8g65-j9wg
Sources
NVD, Project advisories (GitHub)

Description

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected software

SoftwareAffected versions
TraefikServers and applications · cpe:a:traefik:traefik
  • Every version before 2.11.14
  • From 3.0.0 before 3.2.1
TraefikServers and applications · github:traefik/traefik
  • Every version up to 1.7.34
  • Every version before 2.11.14
  • Every version before 3.2.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-52003
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-52003
  • GitHub Advisory Database https://github.com/advisories/GHSA-h924-8g65-j9wg
  • github.com https://github.com/traefik/traefik/security/advisories/GHSA-h924-8g65-j9wg