VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Sep 20, 2024· Updated Jun 17, 2026

CVE-2024-45808

CVE-2024-45808

Description

Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the REQUESTED_SERVER_NAME field for access loggers. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Envoyproxy/Envoy2 versions
    cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*range: <1.28.7
    • (no CPE)range: >= 1.31.0, < 1.31.2
  • Envoy/envoyllm-fuzzy
    Range: before 1.31.2, 1.30.x, 1.29.x, 1.28.x
  • osv-coords
    pkg:bitnami/envoy
    Range: < 1.28.7

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.