CVE-2024-45808

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the `REQUESTED_SERVER_NAME` field for access loggers. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-117 CWE-116

Affected software

No affected versions have been published.

Timeline

Published: Sep 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-458097.5Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remot CVE-2024-45815.4The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Add Layer widget in all versions up CVE-2024-458107.5Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling `sendLocalReply`CVE-2024-458114.8Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser.CVE-2024-458126.4Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability CVE-2024-458135.3find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, a CVE-2024-458156.5Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the CVE-2024-458166.5Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to CVE-2024-458177.3In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, t CVE-2024-458186.5The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the (virtual) VGA is in "standard" mode. Locking involv CVE-2024-458195.5PVH guests have their ACPI tables constructed by the toolstack. The construction involves building the tables in local memory, which are th CVE-2024-45827.3A vulnerability classified as critical has been found in Faraday GM8181 and GM828x up to 20240429. Affected is an unknown function of the co