Apache Traffic Server: Invalid Range header causes a crash
CVE-2022-47185
7.5HIGH
Summary
An improper input validation vulnerability exists in the range header of Apache Traffic Server, impacting versions through 9.2.1. This flaw could allow an attacker to craft malicious requests that exploit the input validation error, potentially leading to unintended behavior of the server. Organizations using Apache Traffic Server should investigate and apply appropriate mitigations to prevent exploitation.
Affected Version(s)
Apache Traffic Server 0 <= 9.2.1
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Katsutoshi Ikenoya