CVE-2022-29631

Опубликовано: 06 июн. 2022

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.

Ссылки

https://github.com/oblac/jodd-http/issues/9
Exploit
Issue Tracking
Third Party Advisory
https://github.com/oblac/jodd/issues/787
Exploit
Issue Tracking
Third Party Advisory
https://github.com/oblac/jodd-http/issues/9
Exploit
Issue Tracking
Third Party Advisory
https://github.com/oblac/jodd/issues/787
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jodd:jodd_http:*:*:*:*:*:*:*:*

Версия от 5.0 (включая) до 6.2.1 (исключая)

EPSS

Процентиль: 25%

0.00084

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-74

Связанные уязвимости

CVE-2022-29631

CVSS3: 7.5

ubuntu

больше 3 лет назад

CVE-2022-29631

CVSS3: 7.5

debian

больше 3 лет назад

Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vul ...

GHSA-pp3c-cf6j-m3ff

CVSS3: 7.5

github

больше 3 лет назад

Server-Side Request Forgery in Jodd HTTP

EPSS

Процентиль: 25%

0.00084

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-74