CVE-2011-3368

Exploit

EPSS 90.73%
Veröffentlicht 05.10.2011 22:55:02
Zuletzt bearbeitet 16.06.2026 23:33:09
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 58

NVD 100 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ HTTP Server Version1.3

Apache ≫ HTTP Server Version1.3.0

Apache ≫ HTTP Server Version1.3.1

Apache ≫ HTTP Server Version1.3.1.1

Apache ≫ HTTP Server Version1.3.2

Apache ≫ HTTP Server Version1.3.3

Apache ≫ HTTP Server Version1.3.4

Apache ≫ HTTP Server Version1.3.5

Apache ≫ HTTP Server Version1.3.6

Apache ≫ HTTP Server Version1.3.7

Apache ≫ HTTP Server Version1.3.8

Apache ≫ HTTP Server Version1.3.9

Apache ≫ HTTP Server Version1.3.10

Apache ≫ HTTP Server Version1.3.11

Apache ≫ HTTP Server Version1.3.12

Apache ≫ HTTP Server Version1.3.13

Apache ≫ HTTP Server Version1.3.14

Apache ≫ HTTP Server Version1.3.15

Apache ≫ HTTP Server Version1.3.16

Apache ≫ HTTP Server Version1.3.17

Apache ≫ HTTP Server Version1.3.18

Apache ≫ HTTP Server Version1.3.19

Apache ≫ HTTP Server Version1.3.20

Apache ≫ HTTP Server Version1.3.22

Apache ≫ HTTP Server Version1.3.23

Apache ≫ HTTP Server Version1.3.24

Apache ≫ HTTP Server Version1.3.25

Apache ≫ HTTP Server Version1.3.26

Apache ≫ HTTP Server Version1.3.27

Apache ≫ HTTP Server Version1.3.28

Apache ≫ HTTP Server Version1.3.29

Apache ≫ HTTP Server Version1.3.30

Apache ≫ HTTP Server Version1.3.31

Apache ≫ HTTP Server Version1.3.32

Apache ≫ HTTP Server Version1.3.33

Apache ≫ HTTP Server Version1.3.34

Apache ≫ HTTP Server Version1.3.35

Apache ≫ HTTP Server Version1.3.36

Apache ≫ HTTP Server Version1.3.37

Apache ≫ HTTP Server Version1.3.38

Apache ≫ HTTP Server Version1.3.39

Apache ≫ HTTP Server Version1.3.41

Apache ≫ HTTP Server Version1.3.42

Apache ≫ HTTP Server Version1.3.65

Apache ≫ HTTP Server Version1.3.68

Apache ≫ HTTP Server Version2.0

Apache ≫ HTTP Server Version2.0.9

Apache ≫ HTTP Server Version2.0.28

Apache ≫ HTTP Server Version2.0.28 Updatebeta

Apache ≫ HTTP Server Version2.0.32

Apache ≫ HTTP Server Version2.0.32 Updatebeta

Apache ≫ HTTP Server Version2.0.34 Updatebeta

Apache ≫ HTTP Server Version2.0.35

Apache ≫ HTTP Server Version2.0.36

Apache ≫ HTTP Server Version2.0.37

Apache ≫ HTTP Server Version2.0.38

Apache ≫ HTTP Server Version2.0.39

Apache ≫ HTTP Server Version2.0.40

Apache ≫ HTTP Server Version2.0.41

Apache ≫ HTTP Server Version2.0.42

Apache ≫ HTTP Server Version2.0.43

Apache ≫ HTTP Server Version2.0.44

Apache ≫ HTTP Server Version2.0.45

Apache ≫ HTTP Server Version2.0.46

Apache ≫ HTTP Server Version2.0.47

Apache ≫ HTTP Server Version2.0.48

Apache ≫ HTTP Server Version2.0.49

Apache ≫ HTTP Server Version2.0.50

Apache ≫ HTTP Server Version2.0.51

Apache ≫ HTTP Server Version2.0.52

Apache ≫ HTTP Server Version2.0.53

Apache ≫ HTTP Server Version2.0.54

Apache ≫ HTTP Server Version2.0.55

Apache ≫ HTTP Server Version2.0.56

Apache ≫ HTTP Server Version2.0.57

Apache ≫ HTTP Server Version2.0.58

Apache ≫ HTTP Server Version2.0.59

Apache ≫ HTTP Server Version2.0.60

Apache ≫ HTTP Server Version2.0.61

Apache ≫ HTTP Server Version2.0.63

Apache ≫ HTTP Server Version2.0.64

Apache ≫ HTTP Server Version2.2.0

Apache ≫ HTTP Server Version2.2.1

Apache ≫ HTTP Server Version2.2.2

Apache ≫ HTTP Server Version2.2.3

Apache ≫ HTTP Server Version2.2.4

Apache ≫ HTTP Server Version2.2.6

Apache ≫ HTTP Server Version2.2.8

Apache ≫ HTTP Server Version2.2.9

Apache ≫ HTTP Server Version2.2.10

Apache ≫ HTTP Server Version2.2.11

Apache ≫ HTTP Server Version2.2.12

Apache ≫ HTTP Server Version2.2.13

Apache ≫ HTTP Server Version2.2.14

Apache ≫ HTTP Server Version2.2.15

Apache ≫ HTTP Server Version2.2.16

Apache ≫ HTTP Server Version2.2.18

Apache ≫ HTTP Server Version2.2.19

Apache ≫ HTTP Server Version2.2.20

Apache ≫ HTTP Server Version2.2.21

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	90.73%	0.998

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E

http://www.mandriva.com/security/advisories?name=MDVSA-2013:150

http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html

https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html

http://marc.info/?l=bugtraq&m=134987041210674&w=2

http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html

http://support.apple.com/kb/HT5501

http://rhn.redhat.com/errata/RHSA-2012-0542.html

http://rhn.redhat.com/errata/RHSA-2012-0543.html

http://www.redhat.com/support/errata/RHSA-2011-1391.html

http://kb.juniper.net/JSA10585

http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html

http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html

http://marc.info/?l=bugtraq&m=133294460209056&w=2

http://osvdb.org/76079

http://seclists.org/fulldisclosure/2011/Oct/232

http://seclists.org/fulldisclosure/2011/Oct/273

http://secunia.com/advisories/46288

http://secunia.com/advisories/46414

http://secunia.com/advisories/48551

http://svn.apache.org/viewvc?view=revision&revision=1179239

Patch

http://web.archiveorange.com/archive/v/ZyS0hzECD5zzb2NkvQlt

Patch

Exploit

http://www-01.ibm.com/support/docview.wss?uid=nas2064c7e5f53452ff686257927003c8d42

http://www-01.ibm.com/support/docview.wss?uid=nas2b7c57b1f1035675186257927003c8d48

http://www.contextis.com/research/blog/reverseproxybypass/

http://www.debian.org/security/2012/dsa-2405

http://www.exploit-db.com/exploits/17969

http://www.mandriva.com/security/advisories?name=MDVSA-2011:144

http://www.redhat.com/support/errata/RHSA-2011-1392.html

http://www.securityfocus.com/bid/49957

http://www.securitytracker.com/id?1026144

https://bugzilla.redhat.com/show_bug.cgi?id=740045

Patch

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/70336

https://nvd.nist.gov/vuln/detail/CVE-2011-3368

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2011-3368

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2011-3368

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2011-3368