CVE-2022-2880

Katalog CVE

CVSS 7.5 · High EPSS 1,4%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada golang go. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.

Rincian

Terbit di NVD

14 Oktober 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pkg.go.dev/vuln/GO-2022-1038 advisory vendor
• https://go.dev/cl/432976 patch
• https://go.dev/issue/54663 exploit · issue tracking · advisory pihak ketiga
• https://groups.google.com/g/golang-announce/c/xtuG5faxtaU mailing list · release notes
• https://security.gentoo.org/glsa/202311-09