CVE-2022-35507 Other in n/a
Remote attackers can cause client-side denial of service in Chromium browsers via CRLF injection in Proxmox web interface response headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-35507?
CVE-2022-35507 is a medium-severity vulnerability in n/a, published on 4 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.
Weakness: CWE-74
Which versions are affected by CVE-2022-35507?
It affects 3 products.
Products include Proxmox Proxmox Mail Gateway, Proxmox Pve Http Server, Proxmox Virtual Environment.
How do I fix CVE-2022-35507?
No fix has been published for CVE-2022-35507 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-35507 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-35507 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xfgp-gpjw-wmqr.