CVE-2024-7207
A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients...
CVE-2024-7207 has been rejected by its source and should not be treated as a live vulnerability, published September 19, 2024. Fixed in envoy 1.28.7.
- Severity
- 8.2 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.28.7envoy
Description
Duplicate of CVE-2024-45806.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
envoyBitnami | before 1.28.7, 1.29.0 up to 1.29.9, 1.30.0 up to 1.30.6, 1.31.0 up to 1.31.2 | 1.28.71.29.91.30.61.31.2 |
What each source reports
GitHub Advisories Score usedGHSA-qc32-2j82-w5h3
A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients...
A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to internal-only services or arbitrary external systems. This is a regression of the fix for CVE-2023-27487.
- Record
GHSA-qc32-2j82-w5h3- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
Duplicate of CVE-2024-45806.
- Record
CVE-2024-7207- Updated
- 2026-11-02
EUVDEUVD-2024-48175No score
Duplicate of CVE-2024-45806.
- Record
EUVD-2024-48175- Updated
- 2026-11-03
NVDNo score
Rejected reason: Duplicate of CVE-2024-45806.
- Record
CVE-2024-7207- Updated
- 2026-11-09
OSVBIT-envoy-2024-7207No score
A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to internal-only services or arbitrary external systems. This is a regression of the fix for CVE-2023-27487.
- Record
BIT-envoy-2024-7207- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | NVD | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.