CVE-2022-31005

EUVD-2023-1891
Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a Content Delivery Network.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub_MCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
Affected Products (NVD)
VendorProductVersion
vaporvapor
𝑥
< 4.60.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/vapor/vapor/commit/953a349b539b3e0d3653585c8ffb50c427986df1
https://github.com/vapor/vapor/releases/tag/4.60.3
https://github.com/vapor/vapor/security/advisories/GHSA-vj2m-9f5j-mpr5
https://github.com/vapor/vapor/commit/953a349b539b3e0d3653585c8ffb50c427986df1
https://github.com/vapor/vapor/releases/tag/4.60.3
https://github.com/vapor/vapor/security/advisories/GHSA-vj2m-9f5j-mpr5