{"id":"CVE-2024-7207","aliases":["BIT-envoy-2024-7207","EUVD-2024-48175","GHSA-qc32-2j82-w5h3"],"status":"rejected","title":"A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients...","description":"Duplicate of CVE-2024-45806.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2024-09-19T22:17:51Z","modified":"2026-11-09T19:10:00Z","fixes":[{"ecosystem":"Bitnami","package":"envoy","fixed_in":["1.28.7","1.29.9","1.30.6","1.31.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"envoy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.28.7"},{"introduced":"1.29.0"},{"fixed":"1.29.9"},{"introduced":"1.30.0"},{"fixed":"1.30.6"},{"introduced":"1.31.0"},{"fixed":"1.31.2"}]}]}],"references":[{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-ffhv-fvxq-r6mf","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7207"},{"url":"https://access.redhat.com/security/cve/CVE-2024-7207","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2300352","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qc32-2j82-w5h3"}],"sources":{"cve":[{"id":"CVE-2024-7207","description":"Duplicate of CVE-2024-45806.","status":"rejected","published":"2024-09-19T22:17:51.582Z","modified":"2024-09-30T19:03:20.448Z","updated_at":"2026-11-02T14:34:20.673123Z"}],"euvd":[{"id":"EUVD-2024-48175","description":"Duplicate of CVE-2024-45806.","status":"published","published":"2024-09-19T22:17:51Z","modified":"2024-09-30T19:03:20Z","updated_at":"2026-11-03T00:28:01.909154Z"}],"ghsa":[{"id":"GHSA-qc32-2j82-w5h3","title":"A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients...","description":"A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to internal-only services or arbitrary external systems. This is a regression of the fix for CVE-2023-27487.","status":"published","published":"2024-09-20T00:31:35Z","modified":"2024-09-20T00:31:43Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:58:18.610136Z"}],"nvd":[{"id":"CVE-2024-7207","description":"Rejected reason: Duplicate of CVE-2024-45806.","status":"rejected","published":"2024-09-19T23:15:12.337Z","modified":"2026-11-09T19:10:00.163Z","updated_at":"2026-11-09T22:15:47.319599Z"}],"osv":[{"id":"BIT-envoy-2024-7207","description":"A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to internal-only services or arbitrary external systems. This is a regression of the fix for CVE-2023-27487.","status":"published","published":"2024-09-26T07:10:09.46Z","modified":"2024-09-26T08:12:13.065847Z","updated_at":"2026-11-02T15:28:29.563843Z"}]}}