Detections
Analytics
Alpine: multiple traefik packages: security update to 3.1.3-r0
critical Tenable Self-Hosted Container Security Plugin ID 427470
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain
HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is
routed to the application. For a HTTP client, it should not be possible to remove or modify these headers.
Since the application trusts the value of these headers, security implications might arise, if they can be
modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and
in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as
hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and
3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
(CVE-2024-45410)
See Also
Plugin Details
Severity: Critical
ID: 427470
Version: Revision 1.5
Type: Local
Published: 5/16/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.7
Percentile: 96.49
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N
CVSS Score Source: CVE-2024-45410
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 9.3
Threat Score: 8.9
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 9/19/2024
Reference Information
CVE: CVE-2024-45410