CVE-2022-34914
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Webswing是Webswing公司的一个专门的 Web 服务器，用于在 Web 浏览器中运行基于 Java Swing 和 JavaFX 的应用程序。 Webswing 22.1.3之前版本存在安全漏洞，该漏洞源于允许 X-Forwarded-For header注入。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-34914
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Webswing before 22.1.3 allows X-Forwarded-For header injection. The client IP address is associated with a variable in the configuration page. The {clientIp} variable can be used as an application startup argument. The X-Forwarded-For header can be manipulated by a client to store an arbitrary value that is used to replace the clientIp variable (without sanitization). A client can thus inject multiple arguments into the session startup. Systems that do not use the clientIP variable in the configuration are not vulnerable. The vulnerability is fixed in these versions: 20.1.16, 20.2.19, 21.1.8, 21.2.12, and 22.1.3.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Webswing 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Webswing是Webswing公司的一个专门的 Web 服务器，用于在 Web 浏览器中运行基于 Java Swing 和 JavaFX 的应用程序。 Webswing 22.1.3之前版本存在安全漏洞，该漏洞源于允许 X-Forwarded-For header注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2022-34914
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-34914
请登录查看更多情报信息。
Security Blog Posts for CVE-2022-34914 (1)
Other References for CVE-2022-34914 (1)
-
https://www.webswing.org/docs/20.1/faq/client_ip.html x_refsource_MISC
Same Patch Batch · n/a · 2022-07-08 · 11 CVEs total
| CVE-2022-30852 | Known 安全漏洞 | |
| CVE-2022-31290 | Known 跨站脚本漏洞 | |
| CVE-2022-32115 | Known 跨站脚本漏洞 | |
| CVE-2022-33011 | Known 注入漏洞 | |
| CVE-2022-28624 | Hewlett Packard Enterprise FlexNetwork 和 FlexFabric 跨站脚本漏洞 | |
| CVE-2022-28623 | Hewlett Packard Enterprise IceWall SSO SQL注入漏洞 | |
| CVE-2022-35406 | Burp Suite 输入验证错误漏洞 | |
| CVE-2022-35410 | mat2 路径遍历漏洞 | |
| CVE-2022-35411 | rpc.py 代码问题漏洞 | |
| CVE-2022-35412 | Digital Guardian Agent 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2022-34914
No comments yet