CVE-2022-29361

Katalog CVE

CVSS 9.8 · Critical EPSS 8,1%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada palletsprojects werkzeug. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project

Rincian

Terbit di NVD

25 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

8,1% peluang dieksploitasi; lebih tinggi dari 94,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pallets/werkzeug/commit/9a3a981d70d2e9ec3344b5192f86fcaf3210cd85 patch · advisory pihak ketiga
• https://github.com/pallets/werkzeug/issues/2420 issue tracking · advisory pihak ketiga