CVE-2022-41317

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-697

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_1.patchPatch, Vendor Advisory
http://www.squid-cache.org/Versions/v5/changesets/SQUID-2022_1.patchPatch, Vendor Advisory
https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mqMitigation, Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/09/23/1Mailing List, Mitigation, Patch, Third Party Advisory
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_1.patchPatch, Vendor Advisory
http://www.squid-cache.org/Versions/v5/changesets/SQUID-2022_1.patchPatch, Vendor Advisory
https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mqMitigation, Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/09/23/1Mailing List, Mitigation, Patch, Third Party Advisory

Timeline

Published: Dec 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-413188.6A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB au CVE-2022-413196.1A Reflected Cross-Site Scripting (XSS) vulnerability affects the Veritas Desktop Laptop Option (DLO) application login page (aka the DLOServ CVE-2022-41325.9A flaw was found in JSS. A memory leak in JSS requires non-standard configuration but is a low-effort DoS vector if configured that way (rep CVE-2022-413206.5Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during configuration of the ba CVE-2022-413227.8In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user m CVE-2022-413237.5In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service at CVE-2022-413246.5Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read acc CVE-2022-413257.8An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a craf CVE-2022-413269.8The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to CVE-2022-413274.4A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0 CVE-2022-413287.1A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 th CVE-2022-413295.3An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiProxy version 7.2.0 through 7.2.1 and