CVE-2022-29631 — HIGH (7.5)

Q: How severe is CVE-2022-29631?

CVE-2022-29631 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2022-29631?

Check the references section above for vendor advisories and patch information. Affected products include: Jodd Jodd Http.

Vulnerability Description

Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Jodd	Jodd Http	>= 5.0, < 6.2.1

Related Weaknesses (CWE)

CWE-74

References

https://github.com/oblac/jodd-http/issues/9ExploitIssue TrackingThird Party Advisory
https://github.com/oblac/jodd/issues/787ExploitIssue TrackingThird Party Advisory
https://github.com/oblac/jodd-http/issues/9ExploitIssue TrackingThird Party Advisory
https://github.com/oblac/jodd/issues/787ExploitIssue TrackingThird Party Advisory

FAQ

What is CVE-2022-29631?

CVE-2022-29631 is a vulnerability with a CVSS score of 7.5 (HIGH). Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers t...

How severe is CVE-2022-29631?

CVE-2022-29631 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-29631?

Check the references section above for vendor advisories and patch information. Affected products include: Jodd Jodd Http.