mod_proxy_ajp: Possible request smuggling
CVE-2022-26377

7.5HIGH

Key Information:

Vendor: Apache
Status: Apache Http Server
Vendor: CVE Published:; 9 June 2022

🔔 Create Apache Vulnerability Alert

What is CVE-2022-26377?

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

Affected Version(s)

Apache HTTP Server Apache HTTP Server 2.4 <= 2.4.53

References

https://httpd.apache.org/security/vulnerabilities_24.html

x_refsource_MISC

http://www.openwall.com/lists/oss-security/2022/06/08/2

mailing-listx_refsource_MLIST

https://security.netapp.com/advisory/ntap-20220624-0005/

x_refsource_CONFIRM

EPSS Score

27% chance of being exploited in the next 30 days.

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 9, 2022
Vulnerability Reserved
Mar 3, 2022

Credit

Ricter Z @ 360 Noah Lab

.