CVE-2022-31813: 
Apache HTTP Server vulnerability analysis and mitigation

CVE-2022-31813 affects Apache HTTP Server 2.4.53 and earlier versions. The vulnerability was discovered and reported by Gaetan Ferry from Synacktiv and was publicly disclosed on June 8, 2022. The issue involves the mod_proxy module's handling of X-Forwarded-* headers, where the server may not send these headers to the origin server based on client-side Connection header hop-by-hop mechanism (Apache Security, OSS Security).

The vulnerability exists in the mod_proxy module of Apache HTTP Server where the server may remove the X-Forwarded-* headers from a request based on the client-side Connection header hop-by-hop mechanism. The vulnerability has been assigned a CVSS 3.1 Base Score of 9.8 (Critical) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NetApp Security).

The vulnerability can be exploited to bypass IP-based authentication on the origin server/application. This could potentially allow attackers to circumvent security controls that rely on X-Forwarded-* headers for client identification or authentication (Apache Security, OSS Security).

The vulnerability was fixed in Apache HTTP Server version 2.4.54. Users are recommended to upgrade to this version or later to address the security issue. No alternative workarounds have been published (Apache Security).