CVE-2022-35508

CRITICAL

Proxmox Virtual Environment and Proxmox Mail Gateway - Server-Side Request Forgery via HTTP Proxy

Title source: llm
STIX 2.1

Description

Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox Mail Gateway, privilege escalation to the root@pam account is possible if the backup feature has ever been used, because backup files such as pmg-backup_YYYY_MM_DD_*.tgz have 0644 permissions and contain an authkey value. This is fixed in pve-http-server 4.1-3.

References (4)

Core 4

Scores

CVSS v3 9.8
EPSS 0.0118
EPSS Percentile 63.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-918
Status published
Products (3)
proxmox/proxmox_mail_gateway
proxmox/pve_http_server < 4.1-3
proxmox/virtual_environment
Published Dec 04, 2022
Tracked Since Feb 18, 2026