Vulnerability-Lookup

CVE-2022-28330 (GCVE-0-2022-28330)

Vulnerability from cvelistv5 – Published: 2022-06-08 10:00 – Updated: 2024-08-03 05:48

Title

read beyond bounds in mod_isapi

Summary

Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.

Severity

No CVSS data available.

CWE

CWE-125 - Out-of-bounds Read

Assigner

apache mitre root

References

3 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2022/06/08/3	mailing-listx_refsource_MLIST
https://security.netapp.com/advisory/ntap-2022062…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache HTTP Server	Affected: Apache HTTP Server , ≤ 2.4.53 (custom)	guessed

Credits

The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:48:37.891Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "name": "[oss-security] 20220608 CVE-2022-28330: Apache HTTP Server: read beyond bounds in mod_isapi",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/06/08/3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220624-0005/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows"
          ],
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.53",
              "status": "affected",
              "version": "Apache HTTP Server",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "low"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-24T15:06:22.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "name": "[oss-security] 20220608 CVE-2022-28330: Apache HTTP Server: read beyond bounds in mod_isapi",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/06/08/3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220624-0005/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2022-06-08T00:00:00.000Z",
          "value": "released in 2.4.54"
        }
      ],
      "title": "read beyond bounds in mod_isapi",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2022-28330",
          "STATE": "PUBLIC",
          "TITLE": "read beyond bounds in mod_isapi"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache HTTP Server",
                      "version": {
                        "version_data": [
                          {
                            "platform": "Windows",
                            "version_affected": "\u003c=",
                            "version_name": "Apache HTTP Server",
                            "version_value": "2.4.53"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "low"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-125 Out-of-bounds Read"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://httpd.apache.org/security/vulnerabilities_24.html",
              "refsource": "MISC",
              "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
              "name": "[oss-security] 20220608 CVE-2022-28330: Apache HTTP Server: read beyond bounds in mod_isapi",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/06/08/3"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220624-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220624-0005/"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2022-06-08T00:00:00.000Z",
            "value": "released in 2.4.54"
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-28330",
    "datePublished": "2022-06-08T10:00:34.000Z",
    "dateReserved": "2022-04-01T00:00:00.000Z",
    "dateUpdated": "2024-08-03T05:48:37.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-28330",
      "date": "2026-09-19",
      "epss": "0.0373",
      "percentile": "0.89322"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B39537A1-5A13-491A-B333-BB53FF718EA7",
                  "versionEndIncluding": "2.4.53",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module."
        },
        {
          "lang": "es",
          "value": "Apache HTTP Server versiones 2.4.53 y anteriores en Windows, puede leer m\u00e1s all\u00e1 de los l\u00edmites cuando es configurado para procesar peticiones con el m\u00f3dulo mod_isapi"
        }
      ],
      "id": "CVE-2022-28330",
      "lastModified": "2024-11-21T06:57:10.600",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "NONE",
              "baseScore": 5.0,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "NONE",
              "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 1.4,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2022-06-09T17:15:09.133",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/06/08/3"
        },
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "source": "security@apache.org",
          "url": "https://security.netapp.com/advisory/ntap-20220624-0005/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/06/08/3"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://security.netapp.com/advisory/ntap-20220624-0005/"
        }
      ],
      "sourceIdentifier": "security@apache.org",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-125"
            }
          ],
          "source": "security@apache.org",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-125"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "platforms": [
                  "Windows"
                ],
                "product": "Apache HTTP Server",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThanOrEqual": "2.4.53",
                    "status": "affected",
                    "version": "Apache HTTP Server",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "security@apache.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B39537A1-5A13-491A-B333-BB53FF718EA7",
                    "versionEndIncluding": "2.4.53",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module."
          },
          {
            "lang": "es",
            "value": "Apache HTTP Server versiones 2.4.53 y anteriores en Windows, puede leer m\u00e1s all\u00e1 de los l\u00edmites cuando es configurado para procesar peticiones con el m\u00f3dulo mod_isapi"
          }
        ],
        "id": "CVE-2022-28330",
        "lastModified": "2026-06-17T04:38:24.010",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 5.0,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-06-09T17:15:09.133",
        "references": [
          {
            "source": "security@apache.org",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/06/08/3"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "source": "security@apache.org",
            "url": "https://security.netapp.com/advisory/ntap-20220624-0005/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/06/08/3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://security.netapp.com/advisory/ntap-20220624-0005/"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "security@apache.org",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T07:07:31+00:00",
      "cve": "CVE-2022-28330",
      "id": "CVE-2022-28330",
      "initial_release_date": "2022-06-08T00:00:00+00:00",
      "product_status:fixed": "1",
      "product_status:known_not_affected": "53",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "httpd: mod_isapi: out-of-bounds read",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-28330.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-31T01:44:34Z",
      "cve": "CVE-2022-28330",
      "id": "CVE-2022-28330",
      "initial_release_date": "2023-02-15T03:26:36Z",
      "product_status:known_not_affected": "337",
      "product_status:recommended": "47",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-28330",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-28330.json",
      "version": "22"
    }
  }
}

FKIE_CVE-2022-28330

Vulnerability from fkie_nvd - Published: 2022-06-09 17:15 - Updated: 2026-06-17 04:38

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.

References

URL	Tags
security@apache.org	http://www.openwall.com/lists/oss-security/2022/06/08/3	Mailing List, Third Party Advisory
security@apache.org	https://httpd.apache.org/security/vulnerabilities_24.html	Vendor Advisory
security@apache.org	https://security.netapp.com/advisory/ntap-20220624-0005/
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2022/06/08/3	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://httpd.apache.org/security/vulnerabilities_24.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.netapp.com/advisory/ntap-20220624-0005/

Impacted products

	Vendor	Product	Version
	apache	http_server	*
	microsoft	windows	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "platforms": [
            "Windows"
          ],
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.53",
              "status": "affected",
              "version": "Apache HTTP Server",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B39537A1-5A13-491A-B333-BB53FF718EA7",
              "versionEndIncluding": "2.4.53",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module."
    },
    {
      "lang": "es",
      "value": "Apache HTTP Server versiones 2.4.53 y anteriores en Windows, puede leer m\u00e1s all\u00e1 de los l\u00edmites cuando es configurado para procesar peticiones con el m\u00f3dulo mod_isapi"
    }
  ],
  "id": "CVE-2022-28330",
  "lastModified": "2026-06-17T04:38:24.010",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-06-09T17:15:09.133",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/06/08/3"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
    },
    {
      "source": "security@apache.org",
      "url": "https://security.netapp.com/advisory/ntap-20220624-0005/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/06/08/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20220624-0005/"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-W8XX-CJQJ-C9JQ

Vulnerability from github – Published: 2022-06-10 00:00 – Updated: 2022-06-17 00:01

Details

Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-28330"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-09T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.",
  "id": "GHSA-w8xx-cjqj-c9jq",
  "modified": "2022-06-17T00:01:28Z",
  "published": "2022-06-10T00:00:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28330"
    },
    {
      "type": "WEB",
      "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220624-0005"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2022/06/08/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2022-28330

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.

Aliases

CVE-2022-28330

Aliases

CVE-2022-28330

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-28330",
    "description": "Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.",
    "id": "GSD-2022-28330",
    "references": [
      "https://www.suse.com/security/cve/CVE-2022-28330.html",
      "https://alas.aws.amazon.com/cve/html/CVE-2022-28330.html",
      "https://access.redhat.com/errata/RHSA-2022:8841"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-28330"
      ],
      "details": "Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.",
      "id": "GSD-2022-28330",
      "modified": "2023-12-13T01:19:34.861940Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@apache.org",
        "ID": "CVE-2022-28330",
        "STATE": "PUBLIC",
        "TITLE": "read beyond bounds in mod_isapi"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Apache HTTP Server",
                    "version": {
                      "version_data": [
                        {
                          "platform": "Windows",
                          "version_affected": "\u003c=",
                          "version_name": "Apache HTTP Server",
                          "version_value": "2.4.53"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Apache Software Foundation"
            }
          ]
        }
      },
      "credit": [
        {
          "lang": "eng",
          "value": "The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": [
        {
          "other": "low"
        }
      ],
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-125 Out-of-bounds Read"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://httpd.apache.org/security/vulnerabilities_24.html",
            "refsource": "MISC",
            "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "name": "[oss-security] 20220608 CVE-2022-28330: Apache HTTP Server: read beyond bounds in mod_isapi",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2022/06/08/3"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20220624-0005/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20220624-0005/"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "eng",
          "time": "2022-06-08",
          "value": "released in 2.4.54"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "2.4.53",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2022-28330"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-125"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20220608 CVE-2022-28330: Apache HTTP Server: read beyond bounds in mod_isapi",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2022/06/08/3"
            },
            {
              "name": "https://httpd.apache.org/security/vulnerabilities_24.html",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220624-0005/",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://security.netapp.com/advisory/ntap-20220624-0005/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2022-06-24T16:15Z",
      "publishedDate": "2022-06-09T17:15Z"
    }
  }
}

ICSA-25-133-01

Vulnerability from csaf_cisa - Published: 2025-02-25 13:30 - Updated: 2025-02-25 13:30

Summary

Hitachi Energy Service Suite

Severity

Critical

Scope

16 vulnerabilities in this advisory, including CVE-2022-28330.

CVE-2022-28330

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fixed: 1 product Known affected: 1 product

Open the full advisory

OESA-2022-1784 (CVE-2022-28330)

Vulnerability from osv_openeuler – Published: 2022-07-30 11:05 – Updated: 2026-08-06 11:05 – Source website

Summary

httpd security update

Details

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.(CVE-2022-28330)

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

URL

Type

	https://www.openeuler.org/en/security/safety-bull…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-28330	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "mod_ssl-2.4.43-17.oe1.aarch64.rpm",
          "mod_md-2.4.43-17.oe1.aarch64.rpm",
          "mod_session-2.4.43-17.oe1.aarch64.rpm",
          "httpd-2.4.43-17.oe1.aarch64.rpm",
          "mod_ldap-2.4.43-17.oe1.aarch64.rpm",
          "mod_proxy_html-2.4.43-17.oe1.aarch64.rpm",
          "httpd-debuginfo-2.4.43-17.oe1.aarch64.rpm",
          "httpd-debugsource-2.4.43-17.oe1.aarch64.rpm",
          "httpd-tools-2.4.43-17.oe1.aarch64.rpm",
          "httpd-devel-2.4.43-17.oe1.aarch64.rpm"
        ],
        "noarch": [
          "httpd-filesystem-2.4.43-17.oe1.noarch.rpm",
          "httpd-help-2.4.43-17.oe1.noarch.rpm"
        ],
        "src": [
          "httpd-2.4.43-17.oe1.src.rpm"
        ],
        "x86_64": [
          "mod_ssl-2.4.43-17.oe1.x86_64.rpm",
          "httpd-2.4.43-17.oe1.x86_64.rpm",
          "mod_session-2.4.43-17.oe1.x86_64.rpm",
          "httpd-devel-2.4.43-17.oe1.x86_64.rpm",
          "httpd-debuginfo-2.4.43-17.oe1.x86_64.rpm",
          "mod_md-2.4.43-17.oe1.x86_64.rpm",
          "httpd-debugsource-2.4.43-17.oe1.x86_64.rpm",
          "httpd-tools-2.4.43-17.oe1.x86_64.rpm",
          "mod_proxy_html-2.4.43-17.oe1.x86_64.rpm",
          "mod_ldap-2.4.43-17.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP1",
        "name": "httpd",
        "purl": "pkg:rpm/openEuler/httpd\u0026distro=openEuler-20.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.43-17.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "httpd-debugsource-2.4.43-17.oe1.aarch64.rpm",
          "mod_session-2.4.43-17.oe1.aarch64.rpm",
          "httpd-devel-2.4.43-17.oe1.aarch64.rpm",
          "mod_ldap-2.4.43-17.oe1.aarch64.rpm",
          "httpd-tools-2.4.43-17.oe1.aarch64.rpm",
          "mod_md-2.4.43-17.oe1.aarch64.rpm",
          "mod_proxy_html-2.4.43-17.oe1.aarch64.rpm",
          "httpd-debuginfo-2.4.43-17.oe1.aarch64.rpm",
          "mod_ssl-2.4.43-17.oe1.aarch64.rpm",
          "httpd-2.4.43-17.oe1.aarch64.rpm"
        ],
        "noarch": [
          "httpd-filesystem-2.4.43-17.oe1.noarch.rpm",
          "httpd-help-2.4.43-17.oe1.noarch.rpm"
        ],
        "src": [
          "httpd-2.4.43-17.oe1.src.rpm"
        ],
        "x86_64": [
          "mod_md-2.4.43-17.oe1.x86_64.rpm",
          "httpd-devel-2.4.43-17.oe1.x86_64.rpm",
          "mod_ssl-2.4.43-17.oe1.x86_64.rpm",
          "httpd-tools-2.4.43-17.oe1.x86_64.rpm",
          "mod_ldap-2.4.43-17.oe1.x86_64.rpm",
          "httpd-debuginfo-2.4.43-17.oe1.x86_64.rpm",
          "mod_session-2.4.43-17.oe1.x86_64.rpm",
          "httpd-debugsource-2.4.43-17.oe1.x86_64.rpm",
          "mod_proxy_html-2.4.43-17.oe1.x86_64.rpm",
          "httpd-2.4.43-17.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP3",
        "name": "httpd",
        "purl": "pkg:rpm/openEuler/httpd\u0026distro=openEuler-20.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.43-17.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "mod_proxy_html-2.4.51-9.oe2203.aarch64.rpm",
          "httpd-tools-2.4.51-9.oe2203.aarch64.rpm",
          "mod_ssl-2.4.51-9.oe2203.aarch64.rpm",
          "mod_session-2.4.51-9.oe2203.aarch64.rpm",
          "httpd-2.4.51-9.oe2203.aarch64.rpm",
          "httpd-debugsource-2.4.51-9.oe2203.aarch64.rpm",
          "httpd-devel-2.4.51-9.oe2203.aarch64.rpm",
          "mod_md-2.4.51-9.oe2203.aarch64.rpm",
          "mod_ldap-2.4.51-9.oe2203.aarch64.rpm",
          "httpd-debuginfo-2.4.51-9.oe2203.aarch64.rpm"
        ],
        "noarch": [
          "httpd-filesystem-2.4.51-9.oe2203.noarch.rpm",
          "httpd-help-2.4.51-9.oe2203.noarch.rpm"
        ],
        "src": [
          "httpd-2.4.51-9.oe2203.src.rpm"
        ],
        "x86_64": [
          "httpd-tools-2.4.51-9.oe2203.x86_64.rpm",
          "httpd-debugsource-2.4.51-9.oe2203.x86_64.rpm",
          "httpd-devel-2.4.51-9.oe2203.x86_64.rpm",
          "mod_proxy_html-2.4.51-9.oe2203.x86_64.rpm",
          "httpd-debuginfo-2.4.51-9.oe2203.x86_64.rpm",
          "mod_ldap-2.4.51-9.oe2203.x86_64.rpm",
          "mod_session-2.4.51-9.oe2203.x86_64.rpm",
          "mod_ssl-2.4.51-9.oe2203.x86_64.rpm",
          "httpd-2.4.51-9.oe2203.x86_64.rpm",
          "mod_md-2.4.51-9.oe2203.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS",
        "name": "httpd",
        "purl": "pkg:rpm/openEuler/httpd\u0026distro=openEuler-22.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.51-9.oe2203"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.\r\n\r\nSecurity Fix(es):\r\n\r\nApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.(CVE-2022-28330)",
  "id": "OESA-2022-1784",
  "modified": "2026-08-06T11:05:03Z",
  "published": "2022-07-30T11:05:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1784"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28330"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "httpd security update",
  "upstream": [
    "CVE-2022-28330"
  ]
}

OPENSUSE-SU-2024:12142-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

apache2-2.4.54-1.1 on GA media

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2022-28330.

CVE-2022-28330

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Recommended: 4 products

Open the full advisory

RHSA-2022:8841

Vulnerability from csaf_redhat - Published: 2022-12-08 13:21 - Updated: 2026-08-07 18:01

Summary

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update

Severity

Important

Scope

23 vulnerabilities in this advisory, including CVE-2022-28330.

CVE-2022-28330

An out-of-bounds read vulnerability was found in the mod_isapi module of httpd. The issue occurs when httpd is configured to process requests with the mod_isapi module.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2022:8841

Open the full advisory

RHSA-2022_8841

Vulnerability from csaf_redhat - Published: 2022-12-08 13:21 - Updated: 2024-12-15 21:10

Summary

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update

Severity

Important

Scope

23 vulnerabilities in this advisory, including CVE-2022-28330.

CVE-2022-28330

An out-of-bounds read vulnerability was found in the mod_isapi module of httpd. The issue occurs when httpd is configured to process requests with the mod_isapi module.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2022:8841

Open the full advisory

WID-SEC-W-2022-0192

Vulnerability from csaf_certbund - Published: 2022-06-07 22:00 - Updated: 2024-03-26 23:00

Summary

Apache HTTP Server: Mehrere Schwachstellen

Severity

Mittel

Scope

8 vulnerabilities in this advisory, including CVE-2022-28330.

CVE-2022-28330

In Apache HTTP Server existieren mehrere Schwachstellen. Die Fehler bestehen aufgrund mehrerer Out-of-Bounds-Reads. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen.

Known affected: 21 products

Open the full advisory

WID-SEC-W-2024-1591

Vulnerability from csaf_certbund - Published: 2024-07-10 22:00 - Updated: 2024-11-11 23:00

Summary

Juniper JUNOS: Mehrere Schwachstellen

Severity

Mittel

Scope

281 vulnerabilities in this advisory, including CVE-2022-28330.

CVE-2022-28330

Es existieren mehrere Schwachstellen in verschiedenen Juniper-Produkten. Ursachen sind unter Anderem Ungenügende Eingabeüberprüfungen, Unsachgemäße Überprüfung und Verarbeitung von Paketen, fehlende Speicherfreigaben, fehlerhafte Behandlung von Ausnahmen, Unsachgemäße Speicherbehandlung, unkontrollierter Ressourcenverbrauch, Klartextspeicherung von Daten und Pufferüberläufe. Diese Schwachstellen ermöglichen Angreifern Denial of Service Zustände zu verursachen, Informationen offenzulegen, Code auszuführen, Privilegien zu erweitern und Sicherheitsmechanismen inklusive der Firewall Funktionalität zu umgehen. Zu einer erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-28330 (GCVE-0-2022-28330)

OESA-2022-1784 (CVE-2022-28330)

Tags

Sightings

Nomenclature

Related by attack behaviour