Описание
An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential disclosure.
Ссылки
- ExploitThird Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.0.0 (исключая)
Одно из
cpe:2.3:a:actix:actix-http:*:*:*:*:*:rust:*:*
cpe:2.3:a:actix:actix-http:3.0.0:-:*:*:*:rust:*:*
cpe:2.3:a:actix:actix-http:3.0.0:beta1:*:*:*:rust:*:*
cpe:2.3:a:actix:actix-http:3.0.0:beta2:*:*:*:rust:*:*
cpe:2.3:a:actix:actix-http:3.0.0:beta3:*:*:*:rust:*:*
cpe:2.3:a:actix:actix-http:3.0.0:beta4:*:*:*:rust:*:*
cpe:2.3:a:actix:actix-http:3.0.0:beta5:*:*:*:rust:*:*
cpe:2.3:a:actix:actix-http:3.0.0:beta6:*:*:*:rust:*:*
cpe:2.3:a:actix:actix-http:3.0.0:beta7:*:*:*:rust:*:*
cpe:2.3:a:actix:actix-http:3.0.0:beta8:*:*:*:rust:*:*
Конфигурация 2
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
EPSS
Процентиль: 62%
0.00422
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-444
Связанные уязвимости
CVSS3: 7.5
redhat
больше 4 лет назад
An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential disclosure.
EPSS
Процентиль: 62%
0.00422
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-444