Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2022-35507

Опубликовано: 04 дек. 2022
Источник: nvd
CVSS3: 7.1
CVSS3: 4.3
EPSS Средний

Описание

A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:proxmox:proxmox_mail_gateway:-:*:*:*:*:*:*:*
cpe:2.3:a:proxmox:pve_http_server:*:*:*:*:*:*:*:*
Версия до 4.1-3 (исключая)
cpe:2.3:a:proxmox:virtual_environment:-:*:*:*:*:*:*:*

EPSS

Процентиль: 96%
0.24022
Средний

7.1 High

CVSS3

4.3 Medium

CVSS3

Дефекты

CWE-74
CWE-74

Связанные уязвимости

github логотип

GHSA-xfgp-gpjw-wmqr

CVSS3: 7.1
github
больше 2 лет назад

A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.

EPSS

Процентиль: 96%
0.24022
Средний

7.1 High

CVSS3

4.3 Medium

CVSS3

Дефекты

CWE-74
CWE-74