Vulnerabilities > Apache > Brpc

DATE CVE VULNERABILITY TITLE RISK
2024-02-08 CVE-2024-23452 HTTP Request Smuggling vulnerability in Apache Brpc
Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description: The http_parser does not comply with the RFC-7230 HTTP 1.1 specification. Attack scenario: If a message is received with both a Transfer-Encoding and a Content-Length header field, such a message might indicate an attempt to perform request smuggling or response splitting. One particular attack scenario is that a bRPC made http server on the backend receiving requests in one persistent connection from frontend server that uses TE to parse request with the logic that 'chunk' is contained in the TE field.
network
low complexity
apache CWE-444
7.5
2023-10-16 CVE-2023-45757 Cross-site Scripting vulnerability in Apache Brpc
Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http request to bRPC server with rpcz enabled can inject arbitrary XSS code to the builtin rpcz page. Solution (choose one of three): 1.
network
low complexity
apache CWE-79
6.1
2023-05-08 CVE-2023-31039 Improper Input Validation vulnerability in Apache Brpc
Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An attacker that can influence the ServerOptions pid_file parameter with which the bRPC server is started can execute arbitrary code with the permissions of the bRPC process. Solution: 1.
network
low complexity
apache CWE-20
critical
9.8