CVE Vulnerabilities for Burp Suite Enterprise Edition
| CVE | Published | Severity | Details | Exploitability | Impact | Vector |
|---|---|---|---|---|---|---|
| CVE‑2022‑35406 | 2022‑07‑08 16:15:08 | MEDIUM (4) | A URL disclosure issue was discovered in Burp Suite before 2022.6. If a user views a crafted response in the Repeater or Intruder, it may be incorrectly interpreted as a redirect. | 3 | 1 | NETWORK |
| CVE‑2021‑44230 | 2021‑11‑30 19:15:10 | MEDIUM (7) | PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an adversary who has already compromised a valid Windows account on the server via separate means. In this scenario, the compromised account may have inherited read access to sensitive configuration, database, and log files. | 3 | 4 | NETWORK |
| CVE‑2021‑29416 | 2021‑03‑29 18:15:13 | MEDIUM (7) | An issue was discovered in PortSwigger Burp Suite before 2021.2. During viewing of a malicious request, it can be manipulated into issuing a request that does not respect its upstream proxy configuration. This could leak NetNTLM hashes on Windows systems that fail to block outbound SMB. | 3 | 4 | NETWORK |
| CVE‑2018‑1153 | 2018‑06‑18 14:29:00 | MEDIUM (6) | Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in the middle to modify or view traffic. | 0 | 0 | NETWORK |
| CVE‑2018‑10377 | 2018‑06‑17 16:29:00 | MEDIUM (4) | PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers to obtain interaction data. | 0 | 0 | NETWORK |
| CVE‑2017‑18285 | 2018‑06‑04 06:29:00 | LOW (4) | The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change. | 0 | 0 | LOCAL |
| CVE‑2017‑18284 | 2018‑06‑04 06:29:00 | LOW (4) | The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL. | 0 | 0 | LOCAL |
View OS-specific patching for:
Windows Mac Linux
Logos, products, trade names, and company names are all the property of their respective trademark holders.
The above listing includes products that Lavawall® monitors through public information and/or proprietary statistical analysis.
Although we do have a partner relationship with some of the listed products and companies, they do not necessarily endorse Lavawall® or have integrations with our systems.