Vulnerability in Soketi
CVE-2022-21667
soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with the Pusher Protocol, it will crash the server. All users that run the server are affected by this vulnerability and it's highly recommended to upgrade to the latest patch. There are no workarounds for this issue.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.016 (75.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 75.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
- Soketi — versions < 0.24.1
- Soketi Project
Weakness classification (CWE)
References
- github.com/soketi/soketi/security/advisories/GHSA-86ch-6w7v-v6xf (Third Party Advisory)
- github.com/soketi/soketi/commit/4b12efef9c31117c36a0a0f1c3aa32114e86364b (Patch, Third Party Advisory)
- github.com/soketi/soketi/releases/tag/0.24.1 (Third Party Advisory, Release Notes)
Frequently asked questions
- What is CVE-2022-21667?
- CVE-2022-21667 is a high-severity vulnerability in Soketi, classified under Improper Handling of Exceptional Conditions. CVSS score: 7.5/10. Published 2022-01-10.
- How severe is CVE-2022-21667?
- High severity. CVSS v3 base score is 7.5 out of 10.