Description

In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.

Remediation

References

CVE-2022-29404

Related Vulnerabilities

IBM RTC Improper Neutralization of HTTP Headers for Scripting Syntax Vulnerability (CVE-2024-51454)

Liferay Portal CVE-2022-42126 Vulnerability (CVE-2022-42126)

WordPress Plugin Product Slider For WooCommerce Lite includes Backdoor [Only if downloaded via the vendor website] (1.1.5)

WordPress Plugin Mapplic-Custom Interactive Map Server-Side Request Forgery (6.1)

WordPress Plugin Content Control-User Access Restriction Cross-Site Scripting (1.1.9)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CVE-2022-29404