CVE-2022-33988

Katalog CVE

CVSS 7.5 · High EPSS 1,2%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada dproxy-nexgen project dproxy-nexgen. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transaction id (TXID) value from client queries, which allows attackers (able to send queries to the resolver) to conduct DNS cache-poisoning attacks because the TXID value is known to the attacker.

Rincian

Terbit di NVD

15 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://sourceforge.net/projects/dproxy/ product · advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2022/08/14/3 exploit · mailing list · advisory pihak ketiga
• https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner advisory pihak ketiga