Home > Vulnerability Database > CVE-2022-45060

Mend.io Vulnerability Database

CVE-2022-45060

Date: November 8, 2022

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

Language: C

Severity Score

7.5

Related Resources (15)

Url: https://varnish-cache.org/security/VSV00011.html

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5/

Url: https://www.debian.org/security/2023/dsa-5334

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XGF6LFTHXCSYMYUX5HLMVXQH3WHCSFLU/

Url: https://docs.varnish-software.com/security/VSV00011

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGF6LFTHXCSYMYUX5HLMVXQH3WHCSFLU/

Url: https://access.redhat.com/security/cve/CVE-2022-45060

Url: https://lists.debian.org/debian-lts-announce/2022/11/msg00036.html

Url: https://security-tracker.debian.org/tracker/CVE-2022-45060

Url: https://nvd.nist.gov/vuln/detail/CVE-2022-45060

Url: https://security.alpinelinux.org/vuln/CVE-2022-45060

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5/

Url: https://www.mend.io/vulnerability-database/CVE-2022-45060

Severity Score

7.5

Weakness Type (CWE)

Improper Input Validation

CWE-20

Insufficient Information

NVD-CWE-noinfo

CVSS v3.1

Base Score:	7.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	HIGH
Availability (A):	NONE

Mend.io Vulnerability Database

We found results for “”

CVE-2022-45060

Date: November 8, 2022

Language: C

Severity Score

Related Resources (15)

Severity Score

Weakness Type (CWE)

CVSS v3.1

Do you need more information?