Veracode Vulnerability DatabaseVERACODE:37281Information Disclosure
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
41.9%
squid is vulnerable to information disclosure. The vulnerability exits due to inconsistent handling of internal URIs, which allows an attacker to gain access to cache manager information in the file system via bypassing the manager ACL protection.
References
git://git.launchpad.net/ubuntu-cve-tracker/tree/active/CVE-2022-41317
www.squid-cache.org/Versions/v4/changesets/SQUID-2022_1.patch
www.squid-cache.org/Versions/v5/changesets/SQUID-2022_1.patch
bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-41317
bugzilla.suse.com/show_bug.cgi?id=CVE-2022-41317
github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq
security-tracker.debian.org/tracker/CVE-2022-41317
www.openwall.com/lists/oss-security/2022/09/23/1
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
41.9%