HIGH🇵🇱 Wersja polska

CVE-2022-45060

CVSS 7.5v3.1pub. 2022-11-09upd. 2025-05-01

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

  • Debian

    OS
    Debian
    10.011.0

  • Fedora Project Fedora

    OS
    Fedoraproject
    353637

  • Varnish Cache Project Varnish Cache

    APP
    Varnish Cache Project
    7.2.07.0.0 – 7.1.2 (bez)5.0.0 – 6.0.11 (bez)

  • Varnish Software Varnish Cache

    APP
    Varnish-Software
    6.0.0 – 6.0.11 (bez)

  • Varnish Software Varnish Cache Plus

    APP
    Varnish-Software
    6.0.06.0.16.0.106.0.26.0.36.0.46.0.56.0.66.0.76.0.86.0.9
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-24061CRITICAL9.8⚠ KEVPL ✓ten sam produkt

GNU Inetutils telnetd: ominięcie uwierzytelnienia przez zmienną USER

CVE-2025-32463CRITICAL9.3⚠ KEVPL ✓ten sam produkt

Sudo: eskalacja uprawnień do root poprzez opcję --chroot (CVE-2025-32463)

CVE-2025-49113CRITICAL9.9⚠ KEVPL ✓ten sam produkt

RCE przez deserializację PHP w Roundcube Webmail (parametr _from)

CVE-2025-32433CRITICAL10.0⚠ KEVPL ✓ten sam produkt

Erlang/OTP SSH — nieuwierzytelniony RCE (CVSS 10.0)

CVE-2025-24201CRITICAL10.0⚠ KEVPL ✓ten sam produkt

Apple WebKit: out-of-bounds write umożliwiający ucieczkę z sandbox przeglądarki