CVE-2022-3854

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-177

Affected software

Vendor	Product	Versions
n/a	ceph	As shipped with Red Hat Ceph 3, 4, and 5.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2139925Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2139925Issue Tracking

Timeline

Published: Mar 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-385409.8Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session inte CVE-2022-385419.8Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the CVE-2022-385429.8Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface. CVE-2022-385459.6Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a CVE-2022-385469.8A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker CVE-2022-385477.2A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN CVE-2022-38554.8The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow high privilege users su CVE-2022-385505.4A stored cross-site scripting (XSS) vulnerability in the /weibo/list component of Jeesns v2.0.0 allows attackers to execute arbitrary web sc CVE-2022-385536.1Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Sear CVE-2022-385559.8Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name.CVE-2022-385569.8Trendnet TEW733GR v1.03B01 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.CVE-2022-385579.8D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.