CVE-2022-2764 : A flaw was found in Undertow. Denial of service can be achieved as Undertow serv

A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations.

Published 2022-09-01 21:15:10

Updated 2022-11-07 19:12:56

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2022-2764

Redhat » Jboss Enterprise Application Platform » Version: 7.0.0
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
Matching versions
Redhat » Jboss Fuse » Version: 7.0.0
cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*
Matching versions
Redhat » Undertow
Versions from including (>=) 2.0.0 and up to, including, (<=) 2.2.19
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*
Matching versions
Redhat » Undertow » Version: 2.3.0 Update Alpha1
cpe:2.3:a:redhat:undertow:2.3.0:alpha1:*:*:*:*:*:*
Matching versions
Redhat » Undertow » Version: 2.3.0 Update Alpha2
cpe:2.3:a:redhat:undertow:2.3.0:alpha2:*:*:*:*:*:*
Matching versions
Redhat » Single Sign-on » Version: 7.0
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Integration Camel K » Version: N/A
cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*
Matching versions
Netapp » Oncommand Workflow Automation » Version: N/A
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
Matching versions
Netapp » Oncommand Insight » Version: N/A
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
Matching versions
Netapp » Active Iq Unified Manager » Version: N/A For Vmware Vsphere
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Matching versions
Netapp » Active Iq Unified Manager » Version: N/A For Windows
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
Matching versions
Netapp » Active Iq Unified Manager » Version: N/A For Linux
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
Matching versions
Netapp » Cloud Secure Agent » Version: N/A
cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2022-2764

Top countries where our scanners detected CVE-2022-2764

Top open port discovered on systems with this issue 80

IPs affected by CVE-2022-2764 389

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2022-2764!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2022-2764

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 25 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-2764

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	1.2	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2022-2764

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Assigned by: secalert@redhat.com (Secondary)

References for CVE-2022-2764

https://bugzilla.redhat.com/show_bug.cgi?id=2117506

2117506 – (CVE-2022-2764) CVE-2022-2764 Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations
Issue Tracking;Vendor Advisory
https://security.netapp.com/advisory/ntap-20221014-0006/

August 2022 Undertow Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url