Pve HTTP Server vulnerabilities

2 known vulnerabilities in Pve HTTP Server from Proxmox. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Proxmox Mail Gateway: Server-Side Request Forgery

  CVE-2022-35508Dec 4, 2022ProxmoxEPSS 1.26%

  Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure

• 7.1 High severity

  Proxmox Mail Gateway: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2022-35507Dec 4, 2022ProxmoxEPSS 1.51%

  A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side D