Lucene search

MitreCVE-2022-38668

HistoryAug 22, 2022 - 8:15 p.m.

CVE-2022-38668

2022-08-2220:15:08

CWE-908

mitre

web.nvd.nist.gov

cve-2022-38668

crow

http server

vulnerability

stack memory

security issue

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

52.9%

JSON

HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller than 16 KB.

Affected configurations

Nvd

Node

crowcppcrowMatch1.0\+4

VendorProductVersionCPE
crowcppcrow1.0+4cpe:2.3:a:crowcpp:crow:1.0\+4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
crowcpp	crow	1.0+4	cpe:2.3:a:crowcpp:crow:1.0\+4:::::::*

References

github.com/0xhebi/CVEs/blob/main/Crow/CVE-2022-38668.md

github.com/CrowCpp/Crow/pull/523

gynvael.coldwind.pl/?id=752

Social References

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

52.9%

JSON

Related for CVE-2022-38668