CVE-2022-31684

reactor-netty-http: Log request headers in some cases of invalid HTTP requests

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.

El servidor HTTP de Reactor Netty, en versiones 1.0.11 - 1.0.23, puede registrar los encabezados de petición en algunos casos de peticiones HTTP no válidas. Los encabezados registradas pueden revelar los tokens de acceso válidos a aquellos con acceso a los registros del servidor. Esto puede afectar sólo a las peticiones HTTP inválidas en las que el registro a nivel WARN está activado

A flaw was found in the Reactor Netty HTTP Server, which may log request headers in some cases of invalid HTTP requests. This could allow an attacker to access privileged information when WARN level logging is enabled.

*Credits: N/A

CVSS Scores

NISTv3.1 4.3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-05-25 CVE Reserved
2022-10-19 CVE Published
2024-05-11 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-117: Improper Output Neutralization for Logs

CAPEC

References (3)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://tanzu.vmware.com/security/cve-2022-31684	2022-10-21
https://access.redhat.com/security/cve/CVE-2022-31684	2023-08-16
https://bugzilla.redhat.com/show_bug.cgi?id=2141353	2023-08-16

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Pivotal Search vendor "Pivotal"		Reactor Netty Search vendor "Pivotal" for product "Reactor Netty"				>= 1.0.11 <= 1.0.23 Search vendor "Pivotal" for product "Reactor Netty" and version " >= 1.0.11 <= 1.0.23"		-		Affected