How severe is CVE-2022-45956?

CVE-2022-45956 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2022-45956 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-45956?

CVE-2022-45956 primarily affects Boa. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-45956?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-45956 published?

CVE-2022-45956 was published on 2022-12-12 and last updated on 2026-06-17.

CVE-2022-45956

CVE-2022-45956 is a medium-severity vulnerability in Boa with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-863.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 1% (53rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-863
Affected product: Boa
Published: 2022-12-12
Last modified: 2026-06-17

Description

Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic Authorization mechanism.

Frequently asked questions

What is CVE-2022-45956?: Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic Authorization mechanism.
How severe is CVE-2022-45956?: CVE-2022-45956 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2022-45956 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-45956?: CVE-2022-45956 primarily affects Boa. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-45956?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-45956 published?: CVE-2022-45956 was published on 2022-12-12 and last updated on 2026-06-17.

References

https://packetstormsecurity.com/files/169962/Boa-Web-Server-0.94.13-0.94.14-Authentication-Bypass.html

Affected products (2)

cpe:2.3:a:boa:boa:0.94.13:*:*:*:*:*:*:*
cpe:2.3:a:boa:boa:0.94.14:*:*:*:*:*:*:*

More vulnerabilities in Boa

CVE-2022-44117 — Critical (CVSS 9.8): Boa 0.94.14rc21 is vulnerable to SQL Injection via username. NOTE: the is disputed by multiple third parties because…
CVE-2018-21027 — Critical (CVSS 9.8): Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is…
CVE-2021-33558 — High (CVSS 7.5): Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html,…
CVE-2018-21028 — High (CVSS 7.5): Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.
CVE-2017-9833 — High (CVSS 7.5): /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read…
CVE-2016-9564 — High (CVSS 7.5): Buffer overflow in send_redirect() in Boa Webserver 0.92r allows remote attackers to DoS via an HTTP GET request…

All CVEs affecting Boa →

Other CWE-863 (Incorrect Authorization) vulnerabilities

CVE-2026-48286 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization…
CVE-2026-48303 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization…
CVE-2026-44330 — Critical (CVSS 10.0): free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the…
CVE-2026-46595 — Critical (CVSS 10.0): Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
CVE-2026-33105 — Critical (CVSS 10.0): Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over…
CVE-2026-32213 — Critical (CVSS 10.0): Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Browse all CWE-863 (Incorrect Authorization) vulnerabilities →