CVE-2023-38522 Vulnerability Details

  /     /     /  

CVE-2023-38522 Metadata Quick Info

CVE Published: 26/07/2024 | CVE Updated: 13/08/2024 | CVE Year: 2023
Source: apache | Vendor: Apache Software Foundation | Product: Apache Traffic Server
Status : PUBLISHED

---

CVE-2023-38522 Description

Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-444
CWE Name: CWE-444 Inconsistent Interpretation of HTTP Requests ( HTTP Request Smuggling )
Source: Apache Software Foundation

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).