Vendor
Vulnerability in Traefik Allows Security Policy Bypass
1 IOCA vulnerability has been discovered in Traefik versions 3.7.x prior to 3.7.8, enabling an attacker to bypass security policies, potentially leading to unauthorized access or actions.
Multiple Security Policy Bypass Vulnerabilities in Traefik Edge Router
3 IOCsMultiple vulnerabilities have been discovered in Traefik, affecting versions 3.6.x prior to 3.6.23, 3.7.x prior to 3.7.7, and versions prior to 2.11.52, which allow an attacker to bypass security policies, potentially leading to unauthorized access or actions.
Traefik Security Policy Bypass Vulnerability
1 rule 1 TTPA security policy bypass vulnerability exists in Traefik versions prior to v2.11.46, v3.6.x before v3.6.17, and v3.7.x before v3.7.1, allowing attackers to potentially circumvent intended access controls.
Traefik Data Confidentiality Vulnerability
2 rules 1 TTPA vulnerability in Traefik allows an attacker to compromise the confidentiality of data, affecting versions v2.11.x prior to v2.11.44, v3.6.x prior to v3.6.15, and v3.7.0-rc.x prior to v3.7.0-rc.3.
Traefik ForwardAuth Authentication Bypass via X-Forwarded-Prefix Spoofing
2 rules 1 TTPA high-severity authentication bypass vulnerability exists in Traefik's `ForwardAuth` middleware when `trustForwardHeader=false` is configured and Traefik is deployed behind a trusted upstream proxy; Traefik fails to sanitize the `X-Forwarded-Prefix` header, allowing attackers to spoof a trusted prefix value and gain unauthorized access to protected backend routes.
Web Server Local File Inclusion Activity Detected
3 rules 4 TTPsDetection of potential Local File Inclusion (LFI) activity on web servers through HTTP GET requests attempting to access sensitive local files via directory traversal or known file paths, potentially leading to information disclosure and system compromise.
Potential HTTP Downgrade Attack Detected
2 rules 1 TTPThe new_terms rule detects potential HTTP downgrade attacks by identifying HTTP traffic using a different HTTP version than typically used, potentially exposing systems to vulnerabilities in older protocols.
Web Server Error Response Spike Indicating Reconnaissance
2 rules 2 TTPsAn unusual spike in web server error codes (500, 502, 503, 504) may indicate reconnaissance activities like vulnerability scanning or fuzzing, where attackers probe for weaknesses, potentially leading to exploitation of server-side issues.
Web Server Remote File Inclusion Activity Detected
2 rules 1 TTPThis rule detects potential Remote File Inclusion (RFI) activity on web servers by identifying HTTP GET requests that attempt to access sensitive remote files through directory traversal techniques or known file paths to read sensitive files, gain system information, or further compromise the server.
Web Server Potential Command Injection Request
2 rules 5 TTPsThe rule detects potential command injection attempts via web server requests by identifying URLs that contain suspicious patterns commonly associated with command execution payloads.
Web Server Request Command Injection Attempt
2 rules 5 TTPsDetection of potential command injection attempts via web server requests by identifying URLs containing suspicious patterns associated with command execution payloads, which attackers exploit to execute arbitrary commands on the server.
Web Server Reconnaissance via Unusual User Agents
2 rules 4 TTPsDetection of unusual spikes in web server requests with uncommon or suspicious user-agent strings indicative of reconnaissance attempts to identify web application vulnerabilities or brute-force attacks.
Web Server Local File Inclusion Activity
2 rules 1 TTPThis rule detects potential Local File Inclusion (LFI) exploitation on web servers by identifying HTTP GET requests attempting to access sensitive local files through directory traversal or known file paths, potentially leading to sensitive information disclosure.