PT-2023-14569

CVE-2022-4492

Publicado

2023-02-23

Atualizado

2025-03-12

Descrição por

CVSS 3.1

7.5

Alta

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Undertow (affected versions not specified)

Description The undertow client does not check the server identity presented by the server certificate in https connections, which is a compulsory step that should be performed by default in https and http/2. This issue affects the TLS client protocol.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impactos

Pesquisadores

Sandipan Roy

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-918: Server-Side Request Forgery (SSRF)

Identificadores relacionados

CVE-2022-4492

GHSA-PFCC-3G6R-8RG8

RHSA-2023:1512