CVE-2022-31813

Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.

• CWE-348
• CWE-345

• http://www.openwall.com/lists/oss-security/2022/06/08/8Mailing List, Third Party Advisory
• https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/Third Party Advisory
• https://security.gentoo.org/glsa/202208-20Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220624-0005/Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/06/08/8Mailing List, Third Party Advisory
• https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/Third Party Advisory
• https://security.gentoo.org/glsa/202208-20Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220624-0005/Third Party Advisory

Published

Jun 9, 2022

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31806In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions pr…9.8
• CVE-2022-31807A vulnerability has been identified in Building X - Security…5.5
• CVE-2022-31808A vulnerability has been identified in SiPass integrated AC5…7.8
• CVE-2022-3181An Improper Input Validation vulnerability exists in Trihedr…7.5
• CVE-2022-31810A vulnerability has been identified in SiPass integrated (Al…7.5
• CVE-2022-31812A vulnerability has been identified in SiPass integrated (Al…8.7
• CVE-2022-31814pfSense pfBlockerNG through 2.1.4_26 allows remote attackers…9.8
• CVE-2022-3182Improper Access Control vulnerability in the Duo SMS two-fac…7
• CVE-2022-31827MonstaFTP v2.10.3 was discovered to contain a Server-Side Re…9.1
• CVE-2022-3183Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 conta…9.8
• CVE-2022-31830Kity Minder v1.3.5 was discovered to contain a Server-Side R…9.1
• CVE-2022-31836The leafInfo.match() function in Beego v2.0.3 and below uses…9.8