Vulnerability · Published Feb 23, 2023 · Assigned by redhat
CVE-2022-4492
High 7.5
In plain English
A high-severity server-side request forgery in undertow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)0.6%top 51.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | undertow | 2.3.8-2 | DEBIAN-CVE-2022-4492 |
| Maven | io.undertow:undertow-core | 2.3.5.Final | GHSA-pfcc-3g6r-8rg8 |
| Maven | io.undertow:undertow-core | 2.2.24.Final | GHSA-pfcc-3g6r-8rg8 |
| Ubuntu:25.10 | undertow | no fix listed | UBUNTU-CVE-2022-4492 |
| Ubuntu:26.04:LTS | undertow | no fix listed | UBUNTU-CVE-2022-4492 |
| Ubuntu:26.10 | undertow | no fix listed | UBUNTU-CVE-2022-4492 |
Affected products (as reported)
Weakness: CWE-918