7.5

CVE-2022-45060

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Varnish-software ≫ Varnish Cache SwEditionlts Version >= 6.0.0 < 6.0.11
Varnish-software ≫ Varnish Cache Plus Version6.0.0 Update-
Varnish-software ≫ Varnish Cache Plus Version6.0.0 Updater0
Varnish-software ≫ Varnish Cache Plus Version6.0.0 Updater1
Varnish-software ≫ Varnish Cache Plus Version6.0.0 Updater2
Varnish-software ≫ Varnish Cache Plus Version6.0.1 Updater1
Varnish-software ≫ Varnish Cache Plus Version6.0.1 Updater2
Varnish-software ≫ Varnish Cache Plus Version6.0.1 Updater3
Varnish-software ≫ Varnish Cache Plus Version6.0.1 Updater4
Varnish-software ≫ Varnish Cache Plus Version6.0.1 Updater5
Varnish-software ≫ Varnish Cache Plus Version6.0.2 Updater1
Varnish-software ≫ Varnish Cache Plus Version6.0.3 Updater1
Varnish-software ≫ Varnish Cache Plus Version6.0.3 Updater2
Varnish-software ≫ Varnish Cache Plus Version6.0.3 Updater3
Varnish-software ≫ Varnish Cache Plus Version6.0.3 Updater4
Varnish-software ≫ Varnish Cache Plus Version6.0.3 Updater5
Varnish-software ≫ Varnish Cache Plus Version6.0.3 Updater6
Varnish-software ≫ Varnish Cache Plus Version6.0.3 Updater7
Varnish-software ≫ Varnish Cache Plus Version6.0.3 Updater8
Varnish-software ≫ Varnish Cache Plus Version6.0.3 Updater9
Varnish-software ≫ Varnish Cache Plus Version6.0.4 Updater1
Varnish-software ≫ Varnish Cache Plus Version6.0.4 Updater2
Varnish-software ≫ Varnish Cache Plus Version6.0.4 Updater3
Varnish-software ≫ Varnish Cache Plus Version6.0.5 Updater1
Varnish-software ≫ Varnish Cache Plus Version6.0.5 Updater2
Varnish-software ≫ Varnish Cache Plus Version6.0.5 Updater3
Varnish-software ≫ Varnish Cache Plus Version6.0.6 Updater1
Varnish-software ≫ Varnish Cache Plus Version6.0.6 Updater10
Varnish-software ≫ Varnish Cache Plus Version6.0.6 Updater2
Varnish-software ≫ Varnish Cache Plus Version6.0.6 Updater3
Varnish-software ≫ Varnish Cache Plus Version6.0.6 Updater4
Varnish-software ≫ Varnish Cache Plus Version6.0.6 Updater5
Varnish-software ≫ Varnish Cache Plus Version6.0.6 Updater6
Varnish-software ≫ Varnish Cache Plus Version6.0.6 Updater7
Varnish-software ≫ Varnish Cache Plus Version6.0.6 Updater8
Varnish-software ≫ Varnish Cache Plus Version6.0.6 Updater9
Varnish-software ≫ Varnish Cache Plus Version6.0.7 Updater1
Varnish-software ≫ Varnish Cache Plus Version6.0.7 Updater2
Varnish-software ≫ Varnish Cache Plus Version6.0.7 Updater3
Varnish-software ≫ Varnish Cache Plus Version6.0.8 Updater1
Varnish-software ≫ Varnish Cache Plus Version6.0.8 Updater2
Varnish-software ≫ Varnish Cache Plus Version6.0.8 Updater3
Varnish-software ≫ Varnish Cache Plus Version6.0.8 Updater4
Varnish-software ≫ Varnish Cache Plus Version6.0.8 Updater5
Varnish-software ≫ Varnish Cache Plus Version6.0.8 Updater6
Varnish-software ≫ Varnish Cache Plus Version6.0.8 Updater7
Varnish-software ≫ Varnish Cache Plus Version6.0.9 Updater1
Varnish-software ≫ Varnish Cache Plus Version6.0.9 Updater2
Varnish-software ≫ Varnish Cache Plus Version6.0.9 Updater3
Varnish-software ≫ Varnish Cache Plus Version6.0.9 Updater4
Varnish-software ≫ Varnish Cache Plus Version6.0.9 Updater5
Varnish-software ≫ Varnish Cache Plus Version6.0.9 Updater6
Varnish-software ≫ Varnish Cache Plus Version6.0.9 Updater7
Varnish-software ≫ Varnish Cache Plus Version6.0.10 Updater1
Varnish-software ≫ Varnish Cache Plus Version6.0.10 Updater2
Varnish Cache Project ≫ Varnish Cache Version >= 5.0.0 < 6.0.11
Varnish Cache Project ≫ Varnish Cache Version >= 7.0.0 < 7.1.2
Fedoraproject ≫ Fedora Version35
Fedoraproject ≫ Fedora Version36
Fedoraproject ≫ Fedora Version37
Debian ≫ Debian Linux Version10.0
Debian ≫ Debian Linux Version11.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.76% 0.725
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.