CVE-2024-32638

Katalog CVE

CVSS 6.3 · Medium EPSS 1,1%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada apache apisix. Skor CVSS 3.1 6.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.

Rincian

Terbit di NVD

2 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2024/05/02/2 mailing list · advisory pihak ketiga