VYPR
← All advisories
Medium severity4.0NVD Advisory· Published Aug 1, 2022· Updated Jun 17, 2026

CVE-2022-1561

CVE-2022-1561

Description

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Krakend/Krakend2 versions
    cpe:2.3:a:krakend:krakend:*:*:*:*:community:*:*:*+ 1 more
    • cpe:2.3:a:krakend:krakend:*:*:*:*:community:*:*:*range: <=2.0.2
    • cpe:2.3:a:krakend:krakend:*:*:*:*:enterprise:*:*:*range: <2.0.0
  • Luraproject/Lura
    cpe:2.3:a:luraproject:lura:*:*:*:*:*:*:*:*
    Range: <2.0.2
  • Lura/Lurallm-create
    Range: <2.0.2
  • Krakend/Krakend Cellm-fuzzy2 versions
    <2.0.2+ 1 more
    • (no CPE)range: <2.0.2
    • (no CPE)range: v2.0.2

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.