Whitepaper Name Goes
Mentions the CVE; no further detail.
CVE-2022-22720 EPSS 28.2%
HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier
Apache Software Foundation · Apache HTTP Server
Summary
The flaw lies in Apache HTTP Server, versions 2.4.52 and earlier, where the server fails to close an inbound connection when errors occur while discarding the request body. An attacker who can send crafted HTTP requests to a vulnerable server can exploit this to perform HTTP request smuggling, with the attack vector and any required authentication, user interaction, or configuration conditions not specified in the available information.
Official description · CVE.org
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
23.5 / 100
- Exploited
- Not confirmed
- Reports
- 1
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 14 Mar 2022. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Named in 1 threat report1 reportTrustwave
Reports are matched by finding the exact id CVE-2022-22720 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.