7.5

CVE-2004-0189

Exploit

The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.

Data is provided by the National Vulnerability Database (NVD)
Squid ≫ Squid Version2.0_patch2
Squid ≫ Squid Version2.1_patch2
Squid ≫ Squid Version2.3_stable5
Squid ≫ Squid Version2.4
Squid ≫ Squid Version2.4_stable7
Squid ≫ Squid Version2.5_stable3
Squid ≫ Squid Version2.5_stable4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 5.08% 0.894
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
http://www.securityfocus.com/bid/9778
Patch
Vendor Advisory
Exploit