CVE-2024-45808 MEDIUM

CVE-2024-45808: Malicious log injection via access logs in envoy

Vendor Envoyproxy
Product envoy
Weakness CWE-117
Published September 19, 2024
Last update September 20, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the `REQUESTED_SERVER_NAME` field for access loggers. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Key dates

02Disclosure timeline

September 19, 2024 CVE published
September 20, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-4571 Unauthenticated Log Injection in Splunk IT Service Intelligence (ITSI) CVE-2025-23405 Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Improper Output Neutralization For Logs CVE-2022-32549 log injection in Sling logging CVE-2021-43410 airavata-django-portal allows CRLF log injection because of the lack of escaping in the log statements CVE-2025-0754 Envoyproxy: openshift service mesh 2.6.3 and 2.5.6 envoy header handling allows log injection and potential spoofing