CVE-2022-26377

Опубликовано: 09 июн. 2022

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Средний

Описание

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

Ссылки

http://www.openwall.com/lists/oss-security/2022/06/08/2
Mailing List
Third Party Advisory
https://httpd.apache.org/security/vulnerabilities_24.html
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/
Third Party Advisory
https://security.gentoo.org/glsa/202208-20
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220624-0005/
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/06/08/2
Mailing List
Third Party Advisory
https://httpd.apache.org/security/vulnerabilities_24.html
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/
Third Party Advisory
https://security.gentoo.org/glsa/202208-20
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220624-0005/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Версия от 2.4.0 (включая) до 2.4.54 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.48408

Средний

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-444

Связанные уязвимости

CVE-2022-26377

CVSS3: 7.5

ubuntu

около 3 лет назад

CVE-2022-26377

CVSS3: 6.5

redhat

около 3 лет назад

CVE-2022-26377

CVSS3: 7.5

debian

около 3 лет назад

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling' ...

GHSA-gx9q-f765-xrgg

CVSS3: 7.5

github

около 3 лет назад

BDU:2022-04115

CVSS3: 6.1

fstec

больше 3 лет назад

Уязвимость модуля mod_proxy_ajp веб-сервера Apache HTTP Server, позволяющая нарушителю отправить скрытый HTTP-запрос (атака типа HTTP Request Smuggling)

EPSS

Процентиль: 98%

0.48408

Средний

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-444