CVE-2022-45060

Katalog CVE

CVSS 7.5 · High EPSS 1,0%

Kerentanan Improper Input Validation pada varnish-software varnish cache, varnish-software varnish cache plus +2 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

Rincian

Terbit di NVD

9 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 63 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://docs.varnish-software.com/security/VSV00011 mitigasi · advisory vendor
• https://varnish-cache.org/security/VSV00011.html mitigasi · advisory vendor
• https://lists.debian.org/debian-lts-announce/2022/11/msg00036.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2023/dsa-5334 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6ZMOZVBLZXHE...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGF6LFTHXCSYM...