CVE-2022-28330
Summary
| CVE | CVE-2022-28330 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-06-09 17:15:00 UTC |
| Updated | 2022-06-24 16:15:00 UTC |
| Description | Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. |
Risk And Classification
Problem Types: CWE-125
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Http Server | All | All | All | All |
| Operating System | Microsoft | Windows | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project | MISC | httpd.apache.org | |
| oss-security - CVE-2022-28330: Apache HTTP Server: read beyond bounds in mod_isapi | MLIST | www.openwall.com | |
| June 2022 Apache HTTP Server Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue
Legacy QID Mappings
- 150539 Apache HTTP Server 2.4.53 Multiple Vulnerabilities
- 240996 Red Hat Update for JBoss Core Services (RHSA-2022:8840)
- 296082 Oracle Solaris 11.4 Support Repository Update (SRU) 48.126.1 Missing (CPUJUL2022)
- 353971 Amazon Linux Security Advisory for httpd24 : ALAS-2022-1607
- 353988 Amazon Linux Security Advisory for httpd : ALAS2-2022-1812
- 354482 Amazon Linux Security Advisory for httpd : ALAS2022-2022-202
- 354513 Amazon Linux Security Advisory for httpd : ALAS2022-2022-110
- 354577 Amazon Linux Security Advisory for httpd : ALAS2022-2022-202
- 355264 Amazon Linux Security Advisory for httpd : ALAS2023-2023-072
- 501353 Alpine Linux Security Update for apache2
- 503857 Alpine Linux Security Update for apache2
- 672082 EulerOS Security Update for httpd (EulerOS-SA-2022-2320)
- 672128 EulerOS Security Update for httpd (EulerOS-SA-2022-2291)
- 672254 EulerOS Security Update for httpd (EulerOS-SA-2022-2685)
- 672282 EulerOS Security Update for httpd (EulerOS-SA-2022-2653)
- 690877 Free Berkeley Software Distribution (FreeBSD) Security Update for apache httpd (49adfbe5-e7d1-11ec-8fbd-d4c9ef517024)
- 730739 IBM Aspera Faspex Multiple Security Vulnerabilities (6952319)