CVE-2022-31813: apache software foundation apache http server Use of Less Trusted Source
CVSS: 9.8v3.1CriticalAnalyzed
AliasesALPINE-CVE-2022-31813UBUNTU-CVE-2022-31813DEBIAN-CVE-2022-31813
Published 08-06-2022Last modified 03-08-2024
Vulnerability summary
CVE-2022-31813 is a critical (CVSS 9.8) Use of Less Trusted Source vulnerability in apache software foundation apache http server. EPSS estimates a 3.54% chance of exploitation in the next 30 days, higher than 89.1% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
3.54%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 14 · Related 10Timeline
- 08-06-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
CVSS metrics
5 scores · 4 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
3.54%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.54% on 18-09-2026
18-09-202618-10-2026
EPSS score3.54%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-348Use of Less Trusted SourceThe product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Affected systems
Alpine1 product
- apache2< 2.4.54-r0
Apache1 product
- http_server< 2.4.54
Apache software foundation1 product
- apache http server≥ Apache HTTP Server 2.4, ≤ 2.4.53
Debian1 product
- apache2< 2.4.54-1
Fedoraproject1 product
- fedoraEOL35 | 36
Netapp1 product
Ubuntu1 product
- apache2< 2.4.7-1ubuntu4.22+esm8 | < 2.4.18-2ubuntu3.17+esm6 | < 2.4.29-1ubuntu4.24 | < 2.4.41-4ubuntu3.12 | < 2.4.52-1ubuntu4.1
7 vendors · 7 products
