Unknown
CVE-2022-45060
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2022-45060
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
General Information
Vendors
- debian,
- fedoraproject,
- varnish cache project,
- varnish-software
Products
- debian linux 10.0,
- debian linux 11.0,
- fedora 35,
- fedora 36,
- fedora 37,
- varnish cache,
- varnish cache 7.2.0,
- varnish cache plus 6.0.0,
- varnish cache plus 6.0.1,
- varnish cache plus 6.0.10,
- varnish cache plus 6.0.2,
- varnish cache plus 6.0.3,
- varnish cache plus 6.0.4,
- varnish cache plus 6.0.5,
- varnish cache plus 6.0.6,
- varnish cache plus 6.0.7,
- varnish cache plus 6.0.8,
- varnish cache plus 6.0.9
References
Advisory
Additional Info
Technical Analysis
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
