« Volver al listado

CVE-2022-4492

Estado: ModificadaAlta (7.5)—

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (10)

Redhat — Build OF QuarkusRedhat — Integration Camel FOR Spring BootRedhat — Integration Camel KRedhat — Integration Service RegistryRedhat — Jboss Enterprise Application PlatformRedhat — Jboss FuseRedhat — Migration Toolkit FOR ApplicationsRedhat — Migration Toolkit FOR RuntimesRedhat — Single Sign-onRedhat — Undertow

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-4492",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-4492",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-12T14:33:53.756138Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "undertow",
          "versions": [
            {
              "status": "affected",
              "version": "2.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-02-23T20:15:12.680",
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2022-4492",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153260",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20230324-0002/",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2022-4492",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153260",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20230324-0002/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol."
    }
  ],
  "lastModified": "2026-06-17T05:21:01.660",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE29B9D6-63DC-4779-ACE8-4E51E6A0AF37"
            },
            {
              "criteria": "cpe:2.3:a:redhat:integration_camel_for_spring_boot:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78698F40-0777-4990-822D-02E1B5D0E2C0"
            },
            {
              "criteria": "cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B87C8AD3-8878-4546-86C2-BF411876648C"
            },
            {
              "criteria": "cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF03BDE8-602D-4DEE-BA5B-5B20FDF47741"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72A54BDA-311C-413B-8E4D-388AD65A170A"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B40CCE4F-EA2C-453D-BB76-6388767E5C6D"
            },
            {
              "criteria": "cpe:2.3:a:redhat:migration_toolkit_for_applications:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C2E7E3C-A507-4AB2-97E5-4944D8775CF7"
            },
            {
              "criteria": "cpe:2.3:a:redhat:migration_toolkit_for_runtimes:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F979A5E3-7FFB-45F1-9847-FFBAF0B12067"
            },
            {
              "criteria": "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890"
            },
            {
              "criteria": "cpe:2.3:a:redhat:undertow:2.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0FA5F7F-CCE8-4DF0-8F9D-516F72C30A45"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}