CVE-2022-24112 apisix/batch-requests plugin allows overwriting the X-REAL-IP header

🗓️ 11 Feb 2022 12:20:13Reported by apacheType

CVE-2022-24112 apisix/batch-requests plugin security ris

Reporter	Title	Published	Views	Family All 40
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	25 Feb 202215:17	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	16 Mar 202209:19	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	17 Mar 202208:22	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	22 Feb 202214:09	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	20 Mar 202216:35	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	8 Mar 202217:08	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	3 Dec 202214:31	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	23 May 202522:09	–	githubexploit
GithubExploit	Exploit for CVE-2022-244112	8 Mar 202217:08	–	githubexploit
0day.today	Apache APISIX Remote Code Execution Exploit	7 Mar 202200:00	–	zdt

[
  {
    "product": "Apache APISIX",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.12.1",
        "status": "affected",
        "version": "Apache APISIX 2.12",
        "versionType": "custom"
      },
      {
        "lessThan": "2.10.4",
        "status": "affected",
        "version": "Apache APISIX 2.10",
        "versionType": "custom"
      },
      {
        "lessThan": "Apache APISIX 1*",
        "status": "affected",
        "version": "1.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2022/02/11/3
packetstormsecurity	www.packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
packetstormsecurity	www.packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html
lists	www.lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94

16 Mar 2022 18:06Current

9.9High risk

Vulners AI Score9.9

EPSS0.96182

CWE-290