CVE-2022-37436 : Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response h

Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.

Published 2023-01-17 20:15:12

Updated 2023-09-08 22:15:10

Source Apache Software Foundation

View at NVD, CVE.org

Products affected by CVE-2022-37436

Apache » Http Server
Versions before (<) 2.4.55
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2022-37436

Top countries where our scanners detected CVE-2022-37436

Top open port discovered on systems with this issue 80

IPs affected by CVE-2022-37436 7,934,411

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2022-37436!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2022-37436

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 34 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-37436

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None
5.3	MEDIUM	AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	N/A	N/A	Oracle:CPUOct2023
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2022-37436

CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Assigned by: security@apache.org (Primary)
CWE-436 Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Assigned by: nvd@nist.gov (Secondary)

References for CVE-2022-37436

https://httpd.apache.org/security/vulnerabilities_24.html

httpd 2.4 vulnerabilities - The Apache HTTP Server Project
Release Notes;Vendor Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/202309-01

Apache HTTPD: Multiple Vulnerabilities (GLSA 202309-01) — Gentoo security

CVEs referencing this url