5.4
CVE-2025-30346
- EPSS 0.06%
- Published 21.03.2025 00:00:00
- Last modified 02.04.2025 22:15:20
- Source cve@mitre.org
- Teams watchlist Login
- Open Login
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users. Login
Data is provided by the National Vulnerability Database (NVD)
Varnish-software ≫ Varnish Enterprise Version6.0.11 Updater1
Varnish-software ≫ Varnish Enterprise Version6.0.11 Updater2
Varnish-software ≫ Varnish Enterprise Version6.0.11 Updater3
Varnish-software ≫ Varnish Enterprise Version6.0.11 Updater4
Varnish-software ≫ Varnish Enterprise Version6.0.11 Updater5
Varnish-software ≫ Varnish Enterprise Version6.0.11 Updater6
Varnish-software ≫ Varnish Enterprise Version6.0.11 Updater7
Varnish-software ≫ Varnish Enterprise Version6.0.12 Updater1
Varnish-software ≫ Varnish Enterprise Version6.0.12 Updater2
Varnish-software ≫ Varnish Enterprise Version6.0.12 Updater3
Varnish-software ≫ Varnish Enterprise Version6.0.12 Updater4
Varnish-software ≫ Varnish Enterprise Version6.0.12 Updater5
Varnish-software ≫ Varnish Enterprise Version6.0.12 Updater6
Varnish-software ≫ Varnish Enterprise Version6.0.12 Updater7
Varnish-software ≫ Varnish Enterprise Version6.0.12 Updater8
Varnish-software ≫ Varnish Enterprise Version6.0.12 Updater9
Varnish-software ≫ Varnish Enterprise Version6.0.13 Updater1
Varnish-software ≫ Varnish Enterprise Version6.0.13 Updater2
Varnish-software ≫ Varnish Enterprise Version6.0.13 Updater3
Varnish-software ≫ Varnish Enterprise Version6.0.13 Updater4
Varnish-software ≫ Varnish Enterprise Version6.0.13 Updater5
Varnish-software ≫ Varnish Enterprise Version6.0.13 Updater6
Varnish-software ≫ Varnish Enterprise Version6.0.13 Updater7
Varnish-software ≫ Varnish Enterprise Version6.0.13 Updater8
Varnish-software ≫ Varnish Enterprise Version6.0.13 Updater9
Varnish Cache Project ≫ Varnish Cache Version < 7.6.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.06% | 0.185 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 4.8 | 2.2 | 2.5 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
|
| cve@mitre.org | 5.4 | 2.2 | 2.7 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
|
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.