PatchTheCVEboa vulnerabilities and fixes
Recent CVEs affecting boa, with upgrade or downgrade steps. 3 tracked.
boa has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2022-12-12. Highest priority: CVE-2021-33558 (score 60/100).
- CVE-2022-45956 MEDIUM 5.3 DOWNGRADE Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD H
- CVE-2022-44117 CRITICAL 9.8 DOWNGRADE Boa 0.94.14rc21 is vulnerable to SQL Injection via username
- CVE-2021-33558 HIGH 7.5 DOWNGRADE Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.ht
FAQ
How do I fix boa vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is boa being exploited right now?
None of the tracked boa CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which boa CVE should I patch first?
CVE-2021-33558 currently ranks highest (60/100): Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.ht.