CVE-2022-31684CWE-532

CVE-2022-31684

Medium · published October 20, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00759 · 54.8th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2022-10-20T02:15Z
Affected products (1)
ProductVersionsFixed in
broadcom/reactor_netty≥ 1.0.11, ≤ 1.0.23—
References (2)
https://tanzu.vmware.com/security/cve-2022-31684 · [email protected]https://tanzu.vmware.com/security/cve-2022-31684 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 19 OCT 00:00Z
    Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests
    cvelistv5