This popular open-source web server has some serious security flaws

Hand increasing the protection level by turning a knob
(Image credit: Shutterstock)

OpenLiteSpeed Web Server, a globally popular open-source web server, was carrying a couple of high-severity vulnerabilities, experts have warned.

Threat actors that managed to exploit these flaws would have been given full privilege remote code execution capabilities, noted researchers from Unit 42, Palo Alto Networks’ cybersecurity research arm

The team found OpenLiteSpeed Web Server carried three high-severity vulnerabilities, namely CVE-2022-0073 (an 8.8 severity score, high-severity remote code execution flaw), CVE-2022-0074 (an 8.8 high-severity privilege escalation flaw), and CVE-2022-0072 (a 5.8, medium-severity directory traversal flaw). The vulnerabilities also affected the enterprise version, LiteSpeed Web Server.

Patch ready

Unit 42 has notified LiteSpeed Technologies of its findings which has, subsequently, patched the flaws, and released new versions of the server, urging users to update their software immediately. 

Organizations using OpenLiteSpeed versions 1.5.11 - 1.7.16, as well as LiteSPeed versions 5.4.6 - 6.0.11 are urged to bring their endpoints up to 1.7.16.1 and 6.0.12 as soon as possible. 

According to Unit 42, the LiteSpeed Web Server is the sixth most popular web ofering around, serving roughly 2% of all Web Server applications, with almost 1.9 million unique servers around the world.

“We tried to imitate the actions of an adversary and engaged in research with the intention of finding vulnerabilities and disclosing them to the vendor,” the researchers explained in a blog post

“This research has resulted in finding three vulnerabilities that affect both the enterprise and open source solutions. These could be chained and exploited by an adversary who has the credentials for the admin dashboard, in order to gain privileged code execution on vulnerable components.”

Web servers have come a long way in terms of security and protections, Unit 42 concludes, adding that despite the optimistic outlook, vulnerabilities are still being found due to the rapid pace of technological evolution.

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Flag of the People's Republic of China overlaid with a technological network of wires and circuits.
One of the biggest flaws exploited by Salt Typhoon hackers has had a patch available for years
An abstract image of a lock against a digital background, denoting cybersecurity.
Critical security flaw in Next.js could spell big trouble for JavaScript users
An image of network security icons for a network encircling a digital blue earth.
Industrial networks exposed to attack by faulty Moxa devices
A hacker wearing a hoodie sitting at a computer, his face hidden.
Experts warn this critical PHP vulnerability could be set to become a global problem
A person's fingers type at a keyboard, with a digital security screen with a lock on it overlaid.
Apache Foundation urges users to patch now and fix major security worries
Best free Linux firewalls
SonicWall tells admins to patch worrying SSLVPN flaw immediately
Latest in Security
Data leak
Top home hardware firm data leak could see millions of customers affected
Representational image depecting cybersecurity protection
Third-party security issues could be the biggest threat facing your business
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Latest in News
An image of Pro-Ject's Flatten it closed and opened
Pro-Ject’s new vinyl flattener will fix any warped LPs you inadvertently buy on Record Store Day
EA Sports F1 25 promotional image featuring drivers Oscar Piastri, Carlos Sainz and Oliver Bearman.
F1 25 has been officially announced, with this year's entry marking a return for Braking Point and a 'significant overhaul' for My Team mode
Garmin clippd integration
Garmin's golf watches just got a big software integration upgrade to help you improve your game
Robert Downey Jr reveals himself as Doctor Doom to a delighted crowd at San Diego Comic-Con 2024
Marvel is currently revealing the full cast for Avengers: Doomsday, and I think it's going to be a long-winded announcement
Samsung QN90F on yellow background
Samsung announces US prices for its 2025 mini-LED TV lineup, and it’s good and bad news
Nintendo Switch Lite
Forget the Nintendo Switch 2, the original Switch is getting one last hurrah in a surprise Nintendo Direct tomorrow