CVE-2022-31109

{"id": "CVE-2022-31109", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}]}, "published": "2022-08-01T17:15:08.333", "references": [{"url": "https://github.com/laminas/laminas-diactoros/commit/25b11d422c2e5dad868f68619888763b30f91e2d", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/laminas/laminas-diactoros/security/advisories/GHSA-8274-h5jp-97vr", "tags": ["Mitigation", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://portswigger.net/web-security/host-header", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-444"}, {"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a `Laminas\\Diactoros\\Uri` instance associated with the incoming server request modified to reflect values from `X-Forwarded-*` headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning. Since the `X-Forwarded-*` headers do have valid use cases, particularly in clustered environments using a load balancer, the library offers mitigation measures only in the v2 releases, as doing otherwise would break these use cases immediately. Users of v2 releases from 2.11.1 can provide an additional argument to `Laminas\\Diactoros\\ServerRequestFactory::fromGlobals()` in the form of a `Laminas\\Diactoros\\RequestFilter\\RequestFilterInterface` instance, including the shipped `Laminas\\Diactoros\\RequestFilter\\NoOpRequestFilter` implementation which ignores the `X-Forwarded-*` headers. Starting in version 3.0, the library will reverse behavior to use the `NoOpRequestFilter` by default, and require users to opt-in to `X-Forwarded-*` header usage via a configured `Laminas\\Diactoros\\RequestFilter\\LegacyXForwardedHeaderFilter` instance. Users are advised to upgrade to version 2.11.1 or later to resolve this issue. Users unable to upgrade may configure web servers to reject `X-Forwarded-*` headers at the web server level."}, {"lang": "es", "value": "laminas-diactoros es un paquete PHP que contiene implementaciones de las interfaces de mensajes HTTP PSR-7 y de las interfaces de f\u00e1brica de mensajes HTTP PSR-17. Las aplicaciones que usan Diactoros, y que no est\u00e1n detr\u00e1s de un proxy, o que pueden ser accedidas por proxies no confiables, pueden potencialmente tener el host, el protocolo, y/o el puerto de una instancia de \"Laminas-diactoros\\Uri\" asociada con la petici\u00f3n del servidor entrante modificada para reflejar los valores de los encabezados \"X-Forwarded-*\". Estos cambios pueden conllevar potencialmente a ataques de tipo XSS (si es usada una URL totalmente calificada en los enlaces) y/o envenenamiento de URL. Dado que los encabezados \"X-Forwarded-*\" presentan casos de uso v\u00e1lidos, en particular en entornos de cl\u00fasteres que usan un equilibrador de carga, la biblioteca ofrece medidas de mitigaci\u00f3n s\u00f3lo en las versiones v2, ya que hacer lo contrario romper\u00eda estos casos de uso inmediatamente. Los usuarios de las versiones v2 a partir de la 2.11.1 pueden proporcionar un argumento adicional a \"Laminas\\Diactoros\\ServerRequestFactory::fromGlobals()\" en forma de una instancia de \"Laminas\\Diactoros\\RequestFilter\\RequestFilterInterface\", incluyendo la implementaci\u00f3n de \"Laminas\\Diactoros\\RequestFilter\\NoOpRequestFilter\" que ignora los encabezados \"X-Forwarded-*\". A partir de la versi\u00f3n 3.0, la biblioteca invertir\u00e1 el comportamiento para usar el \"NoOpRequestFilter\" por defecto, y requerir\u00e1 que los usuarios opten por el uso de el encabezado \"X-Forwarded-*\" por medio de una instancia configurada de \"Laminas\\Diactoros\\RequestFilter\\LegacyXForwardedHeaderFilter\". Es recomendado a usuarios actualizar a versi\u00f3n 2.11.1 o posterior para resolver este problema. Los usuarios que no puedan actualizar pueden configurar los servidores web para que rechacen los encabezados \"X-Forwarded-*\" en el nivel del servidor web"}], "lastModified": "2022-08-06T02:41:27.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getlaminas:laminas-diactoros:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "148CB07B-FE2E-4E7B-A8CE-43041B4C4EF5", "versionEndExcluding": "2.11.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}