mod_proxy_ajp: Possible request smuggling
CVE-2022-26377

7.5HIGH

Key Information:

Vendor: Apache
Status: Apache Http Server
Vendor: CVE Published:; 9 June 2022

Summary

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

Affected Version(s)

Apache HTTP Server Apache HTTP Server 2.4 <= 2.4.53

References

https://httpd.apache.org/security/vulnerabilities_24.html

x_refsource_MISC

http://www.openwall.com/lists/oss-security/2022/06/08/2

mailing-listx_refsource_MLIST

https://security.netapp.com/advisory/ntap-20220624-0005/

x_refsource_CONFIRM

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Jun 9, 2022
Vulnerability Reserved
Mar 3, 2022

Collectors

NVD DatabaseMitre Database

Credit

Ricter Z @ 360 Noah Lab

.