CVE-2023-33189

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285

Affected software

Vendor	Product	Versions
pomerium	pomerium	>= 0.22.0, < 0.22.2; >= 0.21.0, < 0.21.4; >= 0.20.0, < 0.20.1; >= 0.19.0, < 0.19.2; >= 0.18.0, < 0.18.1; < 0.17.4

References

https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebbPatch
https://github.com/pomerium/pomerium/releases/tag/v0.17.4Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.18.1Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.19.2Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.20.1Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.21.4Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.22.2Release Notes
https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59pVendor Advisory
https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebbPatch
https://github.com/pomerium/pomerium/releases/tag/v0.17.4Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.18.1Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.19.2Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.20.1Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.21.4Release Notes
https://github.com/pomerium/pomerium/releases/tag/v0.22.2Release Notes
https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59pVendor Advisory

Timeline

Published: May 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-33195.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iDisplay PlatPlay DS allows Stored XSS CVE-2023-331909.8Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an imp CVE-2023-331918.8Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecur CVE-2023-331927.5ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server.CVE-2023-331939.1Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them a CVE-2023-331944.8Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validat CVE-2023-331956.1Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched i CVE-2023-331965.4Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been f CVE-2023-331975.4Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index ut CVE-2023-331987.5tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poiso CVE-2023-331995.3Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed CVE-2023-33208.8The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due