CVE-2022-22720

🗓️ 14 Mar 2022 10:15:29Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 8114 Views

Apache HTTP Server 2.4.52 fails to close inbound connection when errors are encountered, exposing the server to HTTP Request Smugglin

Reporter	Title	Published	Views	Family All 264
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by IBM WebSphere Application Server (CVE-2022-22719, CVE-2022-22720, CVE-2022-22721)	22 Mar 202217:56	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, which is a required product for IBM Tivoli Netcool Configuration Manager (CVE-2022-22719, CVE-2022-22720, CVE-2022-22721)	24 May 202209:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring included WebSphere Application Server and IBM HTTP Server used by WebSphere Application Server	30 Dec 202217:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On (CVE-2022-22719, CVE-2022-22720, CVE-2022-22721)	31 Mar 202202:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in IBM HTTP Server used by IBM Rational ClearQuest (CVE-2022-22719, CVE-2022-22720, CVE-2022-22721)	30 Mar 202202:40	–	ibm
IBM Security Bulletins	WebSphere Application Server and IBM HTTP Server Security Bulletin List	13 Jul 202218:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application Server affect IBM Business Automation Workflow and IBM Business Process Manager	14 Sep 202215:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security SiteProtector System is affected by multiple Apache HTTP Server Vulnerabilities	2 Jun 202202:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge is vulnerable to HTTP request smuggling due to use of Apache HTTP server CVE-2022-22720	21 Jul 202205:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in expat, glibc, http server, dojo, openssl shipped with IBM Cloud Pak System	15 Aug 202221:35	–	ibm

NVD

Vulners

Node

apache http_serverRange≤2.4.52

Node

fedoraproject fedoraMatch34

fedoraproject fedoraMatch35

fedoraproject fedoraMatch36

Node

debian debian_linuxMatch9.0

Node

oracle enterprise_manager_ops_centerMatch12.4.0.0

oracle http_serverMatch12.2.1.3.0

oracle http_serverMatch12.2.1.4.0

oracle zfs_storage_appliance_kitMatch8.8

Node

apple mac_os_xMatch10.15.7security_update_2020-001

apple mac_os_xMatch10.15.7security_update_2021-001

apple mac_os_xMatch10.15.7security_update_2021-002

apple mac_os_xMatch10.15.7security_update_2021-003

apple mac_os_xMatch10.15.7security_update_2021-004

apple mac_os_xMatch10.15.7security_update_2021-005

apple mac_os_xMatch10.15.7security_update_2021-006

apple mac_os_xMatch10.15.7security_update_2021-007

apple mac_os_xMatch10.15.7security_update_2021-008

apple mac_os_xMatch10.15.7security_update_2022-001

apple mac_os_xMatch10.15.7security_update_2022-002

apple mac_os_xMatch10.15.7security_update_2022-003

apple macosRange<10.15.7

apple macosRange11.0–11.6.6

apple macosRange12.0–12.4

[
  {
    "product": "Apache HTTP Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.4.52",
        "status": "affected",
        "version": "Apache HTTP Server 2.4",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2022/03/14/3
support	www.support.apple.com/kb/HT213256
seclists	www.seclists.org/fulldisclosure/2022/May/38
oracle	www.oracle.com/security-alerts/cpujul2022.html
seclists	www.seclists.org/fulldisclosure/2022/May/35
httpd	www.httpd.apache.org/security/vulnerabilities_24.html
support	www.support.apple.com/kb/HT213257
security	www.security.gentoo.org/glsa/202208-20
seclists	www.seclists.org/fulldisclosure/2022/May/33
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/

21 Nov 2024 06:47Current

9.4High risk

Vulners AI Score9.4

CVSS 27.5

CVSS 3.19.8

EPSS0.27458

CWE-444