CVE-2022-40743

2022-12-1912:15:11

CWE-79

[email protected]

web.nvd.nist.gov

cve

apache traffic server

input validation

vulnerability

cross site scripting

cache poisoning

upgrade

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

67.8%

JSON

Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. Users should upgrade to 9.1.4 or later versions.

Affected configurations

Vulners

NVD

Node

apachetraffic_serverRange≤9.1.3

CPENameOperatorVersion
apache:traffic_serverapache traffic serverle8.1.5
apache:traffic_serverapache traffic serverle9.1.3

CPE	Name	Operator	Version
apache:traffic_server	apache traffic server	le	8.1.5
apache:traffic_server	apache traffic server	le	9.1.3

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Traffic Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "9.1.3",
        "status": "affected",
        "version": "9.0.0",
        "versionType": "custom"
      }
    ]
  }
]