Lucene search

K

ApacheCVELIST:CVE-2022-22720

HistoryMar 14, 2022 - 10:15 a.m.

CVE-2022-22720 HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

2022-03-1410:15:29

CWE-444

apache

www.cve.org

1

9.8 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.1%

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

CNA Affected

[
  {
    "product": "Apache HTTP Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.4.52",
        "status": "affected",
        "version": "Apache HTTP Server 2.4",
        "versionType": "custom"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2022/May/33

seclists.org/fulldisclosure/2022/May/35

seclists.org/fulldisclosure/2022/May/38

www.openwall.com/lists/oss-security/2022/03/14/3

httpd.apache.org/security/vulnerabilities_24.html

lists.debian.org/debian-lts-announce/2022/03/msg00033.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/

security.gentoo.org/glsa/202208-20

security.netapp.com/advisory/ntap-20220321-0001/

support.apple.com/kb/HT213255

support.apple.com/kb/HT213256

support.apple.com/kb/HT213257

www.oracle.com/security-alerts/cpuapr2022.html

www.oracle.com/security-alerts/cpujul2022.html

9.8 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.1%