Description

The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function.

Remediation

References

CVE-2022-28614

Related Vulnerabilities

WordPress Plugin Staff Directory:Company Directory Cross-Site Request Forgery (3.6)

Joomla! Core 3.x.x Cross-Site Scripting (3.1.2 - 3.8.7)

Apache Denial of service in mod_lua r:parsebody Vulnerability (CVE-2022-29404)

OpenSSL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2015-0292)

Dolibarr Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-18260)

Severity

Medium

Classification

CVE-2022-28614

Tags

Missing Update Known Vulnerabilities