5.8

CVE-2013-2503

Exploit
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Privoxy ≫ Privoxy Update beta Version <= 3.0.20
Privoxy ≫ Privoxy Version 2.9.0 Update pre-alpha
Privoxy ≫ Privoxy Version 2.9.1 Update pre-alpha
Privoxy ≫ Privoxy Version 2.9.2 Update pre-alpha
Privoxy ≫ Privoxy Version 2.9.3 Update pre-alpha
Privoxy ≫ Privoxy Version 2.9.11 Update alpha
Privoxy ≫ Privoxy Version 2.9.11 Update beta
Privoxy ≫ Privoxy Version 2.9.11 Update pre-alpha
Privoxy ≫ Privoxy Version 2.9.12 Update beta
Privoxy ≫ Privoxy Version 2.9.13 Update beta
Privoxy ≫ Privoxy Version 2.9.14 Update beta
Privoxy ≫ Privoxy Version 2.9.16
Privoxy ≫ Privoxy Version 2.9.18
Privoxy ≫ Privoxy Version 3.0
Privoxy ≫ Privoxy Version 3.0.2
Privoxy ≫ Privoxy Version 3.0.3
Privoxy ≫ Privoxy Version 3.0.5 Update beta
Privoxy ≫ Privoxy Version 3.0.6
Privoxy ≫ Privoxy Version 3.0.7 Update beta
Privoxy ≫ Privoxy Version 3.0.8
Privoxy ≫ Privoxy Version 3.0.9 Update beta
Privoxy ≫ Privoxy Version 3.0.10
Privoxy ≫ Privoxy Version 3.0.11
Privoxy ≫ Privoxy Version 3.0.12
Privoxy ≫ Privoxy Version 3.0.13 Update beta
Privoxy ≫ Privoxy Version 3.0.14 Update beta
Privoxy ≫ Privoxy Version 3.0.15 Update beta
Privoxy ≫ Privoxy Version 3.0.16
Privoxy ≫ Privoxy Version 3.0.17
Privoxy ≫ Privoxy Version 3.0.18
Privoxy ≫ Privoxy Version 3.0.19
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.63% 0.905
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://blog.c22.cc/2013/03/11/privoxy-proxy-authentication-credential-exposure-cve-2013-2503/
Exploit
http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.188&view=markup
http://lists.opensuse.org/opensuse-updates/2013-03/msg00118.html