Lucene search

[email protected]NVD:CVE-2023-27522

HistoryMar 07, 2023 - 4:15 p.m.

CVE-2023-27522

2023-03-0716:15:09

CWE-444

[email protected]

web.nvd.nist.gov

cve-2023-27522

apache http server

mod_proxy_uwsgi

http response smuggling

vulnerability

version 2.4.30

version 2.4.55

special characters

origin response header

truncate

split

client

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

8.5

Confidence

High

EPSS

0.014

Percentile

86.4%

JSON

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.

Special characters in the origin response header can truncate/split the response forwarded to the client.

Affected configurations

Nvd

Node

apachehttp_serverRange2.4.30–2.4.55

Node

debiandebian_linuxMatch10.0

Node

unbituwsgiRange<2.0.22

VendorProductVersionCPE
apachehttp_server*cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
unbituwsgi*cpe:2.3:a:unbit:uwsgi:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	http_server	*	cpe:2.3:a:apache:http_server::::::::
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*
unbit	uwsgi	*	cpe:2.3:a:unbit:uwsgi::::::::