CVE-2022-40743

2022-12-1912:15:11

Debian Security Bug Tracker

security-tracker.debian.org

input validation

apache traffic server

cross site scripting

cache poisoning

upgrade

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.003

Percentile

68.1%

JSON

Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. Users should upgrade to 9.1.4 or later versions.

OSVersionArchitecturePackageVersionFilename
Debian12alltrafficserver< 9.1.4+ds-1trafficserver_9.1.4+ds-1_all.deb
Debian11alltrafficserver< 8.1.10+ds-1~deb11u1trafficserver_8.1.10+ds-1~deb11u1_all.deb
Debian999alltrafficserver< 9.1.4+ds-1trafficserver_9.1.4+ds-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	trafficserver	< 9.1.4+ds-1	trafficserver_9.1.4+ds-1_all.deb
Debian	11	all	trafficserver	< 8.1.10+ds-1~deb11u1	trafficserver_8.1.10+ds-1~deb11u1_all.deb
Debian	999	all	trafficserver	< 9.1.4+ds-1	trafficserver_9.1.4+ds-1_all.deb