Medium severity · published Dec 25, 2022
CVE-2022-41317
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6
6.5
CVSS
1.8%
EPSS
No
On KEV
Description
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
Squid · Squid-cache
4.9 through 4.17; 5.0.6 before 5.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-41317
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-41317
Patch
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_1.patch
Patch
http://www.squid-cache.org/Versions/v5/changesets/SQUID-2022_1.patch
Mitigation
https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq
Mailing List
https://www.openwall.com/lists/oss-security/2022/09/23/1
More from Squid
9.8
CVE-2025-54574
Squid's URN Handling can lead to Buffer Overflow
9.8
CVE-2020-11945
An issue was discovered in Squid before 5.0.2
9.8
CVE-2019-12519
An issue was discovered in Squid through 4.7
9.8
CVE-2019-12524
An issue was discovered in Squid through 4.7
9.8
CVE-2019-12526
An issue was discovered in Squid before 4.9