CVE Feed

    Dashboard / CVE / CVE-2022-45956

    CVE-2022-45956

    Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic Authorization mechanism.

    Published:Dec 12, 2022
    Last Modified:Apr 22, 2025
    EPS:Dec 12, 2022
    EPSS Score:0.00172
    CVSS Score:5.3

    Affected Products

    Vendor
    Boa
    Product
    Boa

    Exploits

    https://packetstormsecurity.com/files/169962/Boa-Web-Server-0.94.13-0.94.14-Authentication-Bypass.htmlhttps://packetstormsecurity.com/files/169962/Boa-Web-Server-0.94.13-0.94.14-Authentication-Bypass.html

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-56498 (CVSS 5.3) — An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web managem…
    CVE-2024-43367 (CVSS 7.5) — Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to…
    CVE-2022-44117 (CVSS 9.8) — Boa 0.94.14rc21 is vulnerable to SQL Injection via username. NOTE: the is disputed by multiple third parties b…
    CVE-2021-33558 (CVSS 7.5) — Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.ht…
    CVE-2018-21028 (CVSS 7.5) — Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free …
    CVE-2018-21027 (CVSS 9.8) — Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is …
    CVE-2017-9833 (CVSS 7.5) — /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET…
    CVE-2016-9564 (CVSS 7.5) — Buffer overflow in send_redirect() in Boa Webserver 0.92r allows remote attackers to DoS via an HTTP GET reque…
    CVE-2009-4496 (CVSS 5) — Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remot…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High