Input validation error in Varnish Cache and Varnish Enterprise - #VU79811
Published: August 22, 2023
Vulnerability identifier: #VU79811
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process or gain access to sensitive information.
The vulnerability exists due to insufficient validation of base64-encoded data in vmod-digest module. A remote attacker can send specially crafted data to the server and bypass HTTP Basic authentication or gain access to sensitive information from reading out of band workspace data.
Affected software
Varnish Cache
Varnish Enterprise
Varnish Enterprise
Remediation
Install updates from vendor's website.
Varnish Enterprise - update to 6.0.11r5