CVE-2022-36760

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.

Database specific

{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-444"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36760.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "2.4"
                },
                {
                    "last_affected":  "2.4.54"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/apache/httpd

Affected ranges

Type

GIT

Repo

https://github.com/apache/httpd

Events

Introduced

da5873e80d6eee7a0838793bf68f1d0254745fbb

Fixed

8201e867f1d4cdf61840625c6c4be901e3f1b6ba

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.4.0"
                },
                {
                    "fixed":  "2.4.55"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36760.json"