CVE-2022-45060
varnish: Request Forgery Vulnerability
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.
Se descubrió un problema de HTTP Request Forgery en Varnish Cache 5.x y 6.x anteriores a 6.0.11, 7.x anteriores a 7.1.2 y 7.2.x anteriores a 7.2.1. Un atacante puede introducir caracteres a través de pseudoencabezados HTTP/2 que no son válidos en el contexto de una línea de solicitud HTTP/1, lo que hace que el servidor Varnish produzca solicitudes HTTP/1 no válidas al backend. Esto, a su vez, podría usarse para explotar vulnerabilidades en un servidor detrás del servidor Varnish. Nota: la serie 6.0.x LTS (anterior a 6.0.11) se ve afectada.
An HTTP Request Forgery issue was discovered in Varnish Cache. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could be used to exploit vulnerabilities in a server behind the Varnish server.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-11-09 CVE Reserved
- 2022-11-09 CVE Published
- 2024-06-01 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-918: Server-Side Request Forgery (SSRF)
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2022/11/msg00036.html | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Search vendor "Varnish-software" for product "Varnish Cache" | >= 6.0.0 < 6.0.11 Search vendor "Varnish-software" for product "Varnish Cache" and version " >= 6.0.0 < 6.0.11" | lts |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.0 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.0" | - |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.0 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.0" | r0 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.0 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.0" | r1 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.0 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.0" | r2 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.1 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.1" | r1 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.1 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.1" | r2 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.1 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.1" | r3 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.1 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.1" | r4 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.1 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.1" | r5 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.2 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.2" | r1 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.3 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.3" | r1 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.3 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.3" | r2 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.3 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.3" | r3 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.3 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.3" | r4 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.3 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.3" | r5 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.3 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.3" | r6 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.3 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.3" | r7 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.3 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.3" | r8 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.3 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.3" | r9 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.4 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.4" | r1 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.4 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.4" | r2 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.4 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.4" | r3 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.5 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.5" | r1 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.5 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.5" | r2 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.5 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.5" | r3 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.6 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.6" | r1 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.6 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.6" | r10 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.6 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.6" | r2 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.6 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.6" | r3 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.6 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.6" | r4 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.6 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.6" | r5 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.6 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.6" | r6 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.6 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.6" | r7 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.6 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.6" | r8 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.6 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.6" | r9 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.7 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.7" | r1 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.7 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.7" | r2 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.7 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.7" | r3 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.8 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.8" | r1 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.8 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.8" | r2 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.8 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.8" | r3 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.8 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.8" | r4 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.8 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.8" | r5 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.8 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.8" | r6 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.8 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.8" | r7 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.9 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.9" | r1 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.9 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.9" | r2 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.9 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.9" | r3 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.9 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.9" | r4 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.9 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.9" | r5 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.9 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.9" | r6 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.9 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.9" | r7 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.10 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.10" | r1 |
Affected
| ||||||
| Varnish-software Search vendor "Varnish-software" | Varnish Cache Plus Search vendor "Varnish-software" for product "Varnish Cache Plus" | 6.0.10 Search vendor "Varnish-software" for product "Varnish Cache Plus" and version "6.0.10" | r2 |
Affected
| ||||||
| Varnish Cache Project Search vendor "Varnish Cache Project" | Varnish Cache Search vendor "Varnish Cache Project" for product "Varnish Cache" | >= 5.0.0 < 6.0.11 Search vendor "Varnish Cache Project" for product "Varnish Cache" and version " >= 5.0.0 < 6.0.11" | - |
Affected
| ||||||
| Varnish Cache Project Search vendor "Varnish Cache Project" | Varnish Cache Search vendor "Varnish Cache Project" for product "Varnish Cache" | >= 7.0.0 < 7.1.2 Search vendor "Varnish Cache Project" for product "Varnish Cache" and version " >= 7.0.0 < 7.1.2" | - |
Affected
| ||||||
| Varnish Cache Project Search vendor "Varnish Cache Project" | Varnish Cache Search vendor "Varnish Cache Project" for product "Varnish Cache" | 7.2.0 Search vendor "Varnish Cache Project" for product "Varnish Cache" and version "7.2.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 35 Search vendor "Fedoraproject" for product "Fedora" and version "35" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 36 Search vendor "Fedoraproject" for product "Fedora" and version "36" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 37 Search vendor "Fedoraproject" for product "Fedora" and version "37" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0" | - |
Affected
| ||||||