// For flags

CVE-2022-40743

Apache Traffic Server: Security issues with the xdebug plugin

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. Users should upgrade to 9.1.4 or later versions.

Una vulnerabilidad de validación de entrada incorrecta para el complemento xdebug en Apache Software Foundation Apache Traffic Server puede provocar ataques de envenenamiento de caché y Cross-Site Scripting. Este problema afecta a Apache Traffic Server: 9.0.0 a 9.1.3. Los usuarios deben actualizar a 9.1.4 o versiones posteriores.

*Credits: Nick Frost
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-16 CVE Reserved
  • 2022-12-19 CVE Published
  • 2024-07-11 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
URL Date SRC
https://lists.apache.org/thread/mrj2lg4s0hf027rk7gz8t7hbn9xpfg02 2023-07-17
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Traffic Server
Search vendor "Apache" for product "Traffic Server"
 >= 8.0.0 <= 8.1.5
Search vendor "Apache" for product "Traffic Server" and version " >= 8.0.0 <= 8.1.5"
-
Affected
Apache
Search vendor "Apache"
 Traffic Server
Search vendor "Apache" for product "Traffic Server"
 >= 9.0.0 <= 9.1.3
Search vendor "Apache" for product "Traffic Server" and version " >= 9.0.0 <= 9.1.3"
-
Affected