CVE-2022-24797 - CVE House
Back to Database
Status published Medium CVE-2022-24797

Exposure of Sensitive Information in Pomerium

Vulnerability Description

Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24797

Credits & Attribution

No credits recorded in the NVD database.

References

More from pomerium

View All →
CVE-2024-47616
Pomerium's service account access token may grant unintended access to databroker API
Medium 6.8
CVE-2024-39315
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response
Medium 5.7
CVE-2023-33189
Incorrect Authorization with specially crafted requests
Critical 10
CVE-2021-41230
OIDC claims not updated from Identity Provider in Pomerium
Medium 5.3
CVE-2021-39206
Incorrect Authorization with specially crafted requests
High 8.6

Affected Vendor

Affected Software

pomerium
Vulnerable Versions:
>= v0.16.0, < v0.17.1

Timeline

Official Publish: March 31st, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration