CVE-2023-38522

HIGH

7.5

Descripcion

Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.

Detalles CVE

Puntuacion CVSS v3.17.5

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado7/26/2024

Ultima modificacion11/3/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

apache:traffic_server

Debilidades (CWE)

CWE-444CWE-444

Referencias

https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0(security@apache.org)

https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2024/09/msg00040.html(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.