Description

In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.

Remediation

References

CVE-2022-29404

Related Vulnerabilities

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2014-3478)

WordPress 4.8.x Multiple Vulnerabilities (4.8 - 4.8.17)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-38902)

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-8656)

MySQL CVE-2022-21328 Vulnerability (CVE-2022-21328)

Severity

Medium

Classification

CVE-2022-29404

Tags

Missing Update Known Vulnerabilities