A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Un uri-path diseñado puede causar que mod_proxy reenvíe la petición a un servidor de origen elegido por el usuario remoto. Este problema afecta a Apache HTTP Server versiones 2.4.48 y anteriores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | CHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:M/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-918
|
| [email protected] | Primary |
en
CWE-918
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| resf | rocky_linux | 8.0 | <built-in method update of dict object at 0x7c3c3372f1c0> | Operating System |
| redhat | enterprise_linux | 8.0 | <built-in method update of dict object at 0x7c3c3372d340> | Operating System |
| redhat | enterprise_linux_eus | 8.1 | <built-in method update of dict object at 0x7c3c3372e400> | Operating System |
| redhat | enterprise_linux_eus | 8.2 | <built-in method update of dict object at 0x7c3c3372c700> | Operating System |
| redhat | enterprise_linux_eus | 8.4 | <built-in method update of dict object at 0x7c3c3372ea40> | Operating System |
| redhat | enterprise_linux_eus | 8.6 | <built-in method update of dict object at 0x7c3c3372d200> | Operating System |
| redhat | enterprise_linux_eus | 8.8 | <built-in method update of dict object at 0x7c3c3372e4c0> | Operating System |
| redhat | enterprise_linux_for_arm_64 | 8.0 | <built-in method update of dict object at 0x7c3c40d593c0> | Operating System |
| redhat | enterprise_linux_for_arm_64_eus | 8.6 | <built-in method update of dict object at 0x7c3c3372cf40> | Operating System |
| redhat | enterprise_linux_for_arm_64_eus | 8.8 | <built-in method update of dict object at 0x7c3c3372fec0> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems | 7.0_s390x | <built-in method update of dict object at 0x7c3c483cbe00> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems | 8.0 | <built-in method update of dict object at 0x7c3bf3a1fc00> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.1 | <built-in method update of dict object at 0x7c3c3372c800> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.4 | <built-in method update of dict object at 0x7c3c40d59fc0> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.8 | <built-in method update of dict object at 0x7c3c40d5ab00> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems_eus_s390x | 8.2 | <built-in method update of dict object at 0x7c3c3372fb00> | Operating System |
| redhat | enterprise_linux_for_power_big_endian | 7.0 | <built-in method update of dict object at 0x7c3bf3a1ef40> | Operating System |
| redhat | enterprise_linux_for_power_little_endian | 7.0 | <built-in method update of dict object at 0x7c3c3372d740> | Operating System |
| redhat | enterprise_linux_for_power_little_endian | 8.0 | <built-in method update of dict object at 0x7c3c48403040> | Operating System |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.1 | <built-in method update of dict object at 0x7c3c483cb740> | Operating System |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.2 | <built-in method update of dict object at 0x7c3c40d81bc0> | Operating System |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.4 | <built-in method update of dict object at 0x7c3c483c9e80> | Operating System |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.6 | <built-in method update of dict object at 0x7c3c3372f580> | Operating System |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.8 | <built-in method update of dict object at 0x7c3c48361100> | Operating System |
| redhat | enterprise_linux_for_scientific_computing | 7.0 | <built-in method update of dict object at 0x7c3c3372e0c0> | Operating System |
| redhat | enterprise_linux_server | 7.0 | <built-in method update of dict object at 0x7c3c2a974f80> | Operating System |
| redhat | enterprise_linux_server_aus | 7.2 | <built-in method update of dict object at 0x7c3c3372f140> | Operating System |
| redhat | enterprise_linux_server_aus | 7.3 | <built-in method update of dict object at 0x7c3c3372c100> | Operating System |
| redhat | enterprise_linux_server_aus | 7.4 | <built-in method update of dict object at 0x7c3c40d5a2c0> | Operating System |
| redhat | enterprise_linux_server_aus | 7.6 | <built-in method update of dict object at 0x7c3c2ab12a80> | Operating System |
| redhat | enterprise_linux_server_aus | 7.7 | <built-in method update of dict object at 0x7c3c480916c0> | Operating System |
| redhat | enterprise_linux_server_aus | 8.2 | <built-in method update of dict object at 0x7c3c297587c0> | Operating System |
| redhat | enterprise_linux_server_aus | 8.4 | <built-in method update of dict object at 0x7c3c48299e40> | Operating System |
| redhat | enterprise_linux_server_aus | 8.6 | <built-in method update of dict object at 0x7c3c2be84500> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 7.6 | <built-in method update of dict object at 0x7c3c2be87500> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 7.7 | <built-in method update of dict object at 0x7c3c2be84040> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.1 | <built-in method update of dict object at 0x7c3bf2b0d140> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.2 | <built-in method update of dict object at 0x7c3c28b14b40> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.4 | <built-in method update of dict object at 0x7c3c40d6d6c0> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.6 | <built-in method update of dict object at 0x7c3c40d6e580> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.8 | <built-in method update of dict object at 0x7c3c40d6f100> | Operating System |
| redhat | enterprise_linux_server_tus | 7.6 | <built-in method update of dict object at 0x7c3bf1847640> | Operating System |
| redhat | enterprise_linux_server_tus | 7.7 | <built-in method update of dict object at 0x7c3c40d6ce00> | Operating System |
| redhat | enterprise_linux_server_tus | 8.2 | <built-in method update of dict object at 0x7c3c40d6ea00> | Operating System |
| redhat | enterprise_linux_server_tus | 8.4 | <built-in method update of dict object at 0x7c3bf1847540> | Operating System |
| redhat | enterprise_linux_server_tus | 8.6 | <built-in method update of dict object at 0x7c3bf18451c0> | Operating System |
| redhat | enterprise_linux_server_tus | 8.8 | <built-in method update of dict object at 0x7c3c40d6dd00> | Operating System |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 7.6 | <built-in method update of dict object at 0x7c3c32d51d00> | Operating System |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 7.7 | <built-in method update of dict object at 0x7c3c2910c940> | Operating System |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.1 | <built-in method update of dict object at 0x7c3c327da340> | Operating System |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.2 | <built-in method update of dict object at 0x7c3c2a9b7e00> | Operating System |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.4 | <built-in method update of dict object at 0x7c3c2a977900> | Operating System |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.6 | <built-in method update of dict object at 0x7c3c3212c600> | Operating System |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.8 | <built-in method update of dict object at 0x7c3c40d6e840> | Operating System |
| redhat | enterprise_linux_workstation | 7.0 | <built-in method update of dict object at 0x7c3bf1846700> | Operating System |
| redhat | jboss_core_services | 1.0 | <built-in method update of dict object at 0x7c3c3277d480> | Application |
| redhat | software_collections | 1.0 | <built-in method update of dict object at 0x7c3c28b14e40> | Application |
| apache | http_server | * | <built-in method update of dict object at 0x7c3c483ca2c0> | Application |
| fedoraproject | fedora | 34 | <built-in method update of dict object at 0x7c3bf2553bc0> | Operating System |
| fedoraproject | fedora | 35 | <built-in method update of dict object at 0x7c3c48266500> | Operating System |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x7c3c2b035700> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7c3bf3e5c980> | Operating System |
| debian | debian_linux | 11.0 | <built-in method update of dict object at 0x7c3c327e2800> | Operating System |
| netapp | cloud_backup | - | <built-in method update of dict object at 0x7c3c480b7b00> | Application |
| netapp | clustered_data_ontap | - | <built-in method update of dict object at 0x7c3c6afb0600> | Application |
| netapp | storagegrid | - | <built-in method update of dict object at 0x7c3c2b034080> | Application |
| broadcom | brocade_fabric_operating_system_firmware | - | <built-in method update of dict object at 0x7c3c32751580> | Operating System |
| f5 | f5os | * | <built-in method update of dict object at 0x7c3bf2b247c0> | Operating System |
| f5 | f5os | * | <built-in method update of dict object at 0x7c3c2a9b4d40> | Operating System |
| oracle | enterprise_manager_ops_center | 12.4.0.0 | <built-in method update of dict object at 0x7c3bf3e5f4c0> | Application |
| oracle | http_server | 12.2.1.3.0 | <built-in method update of dict object at 0x7c3c2b036e40> | Application |
| oracle | http_server | 12.2.1.4.0 | <built-in method update of dict object at 0x7c3bf2b27040> | Application |
| oracle | instantis_enterprisetrack | 17.1 | <built-in method update of dict object at 0x7c3c28b16600> | Application |
| oracle | instantis_enterprisetrack | 17.2 | <built-in method update of dict object at 0x7c3c48402840> | Application |
| oracle | instantis_enterprisetrack | 17.3 | <built-in method update of dict object at 0x7c3c79340dc0> | Application |
| oracle | secure_global_desktop | 5.6 | <built-in method update of dict object at 0x7c3bf3e5ce00> | Application |
| oracle | zfs_storage_appliance_kit | 8.8 | <built-in method update of dict object at 0x7c3c477e6500> | Application |
| siemens | ruggedcom_nms | * | <built-in method update of dict object at 0x7c3c477e7500> | Application |
| siemens | sinec_nms | * | <built-in method update of dict object at 0x7c3c477e4440> | Application |
| siemens | sinema_remote_connect_server | * | <built-in method update of dict object at 0x7c3c477e6780> | Application |
| siemens | sinema_remote_connect_server | 3.2 | <built-in method update of dict object at 0x7c3c477e5040> | Application |
| siemens | sinema_server | 14.0 | <built-in method update of dict object at 0x7c3c477e6380> | Application |
| tenable | tenable.sc | * | <built-in method update of dict object at 0x7c3c477e4c00> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:resf:rocky_linux:8.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
| No | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* |
| No | cpe:2.3:o:redhat:enterprise_linux_server_workstation:7.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:f5:f5os:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:f5:f5os:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:secure_global_desktop:5.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:siemens:ruggedcom_nms:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:siemens:sinema_server:14.0:-:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* |