CVE-2022-41317 : An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to

An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.

Published 2022-12-25 19:15:11

Updated 2023-01-05 02:20:38

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-41317

Squid-cache » Squid
Versions from including (>=) 5.0.6 and before (<) 5.7
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*
Matching versions
Squid-cache » Squid
Versions from including (>=) 4.9 and up to, including, (<=) 4.17
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2022-41317

Top countries where our scanners detected CVE-2022-41317

Top open port discovered on systems with this issue 8000

IPs affected by CVE-2022-41317 891,711

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2022-41317!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2022-41317

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 42 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-41317

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-41317

CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-41317

http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_1.patch

Patch;Vendor Advisory
https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq

SQUID-2022:1 Exposure of Sensitive Information in Cache Manager · Advisory · squid-cache/squid · GitHub
Mitigation;Patch;Third Party Advisory
http://www.squid-cache.org/Versions/v5/changesets/SQUID-2022_1.patch

Patch;Vendor Advisory
https://www.openwall.com/lists/oss-security/2022/09/23/1

oss-security - Fwd: [ADVISORY] SQUID-2022:1 Exposure of Sensitive Information in Cache Manager
Mailing List;Mitigation;Patch;Third Party Advisory