PT-2023-3280 · Apache · Apache Traffic Server

Martin O’Neal + 1 · Published 2023-06-13 · Updated 2024-10-09 · CVE-2022-47184

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 9.2.0

Description The issue is related to the exposure of sensitive information to an unauthorized actor. This can be exploited by a remote attacker to disclose protected information. The vulnerability is associated with a lack of protection for service data.

Recommendations For Apache Traffic Server versions 8.0.0 through 9.2.0, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-03413

CVE-2022-47184

DLA-3475-1

DSA-5435-1

DSA-5435-2

OESA-2023-1972

OESA-2023-1973

OESA-2023-1974

Affected Products

Apache Traffic Server

References · 37

• https://osv.dev/vulnerability/DLA-3475-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30631 · Security Note
• https://security-tracker.debian.org/tracker/DLA-3475-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6GDCBNFDDW6ULW7CACJCPENI7BVDHM5O · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47184 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-47184 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33933 · Security Note
• https://bdu.fstec.ru/vul/2023-03516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-33933 · Security Note
• https://bdu.fstec.ru/vul/2023-03413 · Security Note
• https://bdu.fstec.ru/vul/2023-03423 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-47184 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-5435-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-5435-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-47184 · Vendor Advisory