A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Un uri-path diseñado puede causar que mod_proxy reenvíe la petición a un servidor de origen elegido por el usuario remoto. Este problema afecta a Apache HTTP Server versiones 2.4.48 y anteriores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | CHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:M/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-918
|
| [email protected] | Primary |
en
CWE-918
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| resf | rocky_linux | 8.0 | <built-in method update of dict object at 0x7763d8eaf700> | Operating System |
| redhat | enterprise_linux | 8.0 | <built-in method update of dict object at 0x7763d87a6b00> | Operating System |
| redhat | enterprise_linux_eus | 8.1 | <built-in method update of dict object at 0x7763d8b8af80> | Operating System |
| redhat | enterprise_linux_eus | 8.2 | <built-in method update of dict object at 0x77636c7cad80> | Operating System |
| redhat | enterprise_linux_eus | 8.4 | <built-in method update of dict object at 0x7763d8eac980> | Operating System |
| redhat | enterprise_linux_eus | 8.6 | <built-in method update of dict object at 0x7763d8b89e00> | Operating System |
| redhat | enterprise_linux_eus | 8.8 | <built-in method update of dict object at 0x7763d8edbb40> | Operating System |
| redhat | enterprise_linux_for_arm_64 | 8.0 | <built-in method update of dict object at 0x77636c7cbb80> | Operating System |
| redhat | enterprise_linux_for_arm_64_eus | 8.6 | <built-in method update of dict object at 0x7763d8970300> | Operating System |
| redhat | enterprise_linux_for_arm_64_eus | 8.8 | <built-in method update of dict object at 0x7763d8eadf00> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems | 7.0_s390x | <built-in method update of dict object at 0x77636c7c9300> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems | 8.0 | <built-in method update of dict object at 0x7763a1162940> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.1 | <built-in method update of dict object at 0x7763f05a8340> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.4 | <built-in method update of dict object at 0x7763d8d00580> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.8 | <built-in method update of dict object at 0x7763f05c7400> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems_eus_s390x | 8.2 | <built-in method update of dict object at 0x7763d8d00400> | Operating System |
| redhat | enterprise_linux_for_power_big_endian | 7.0 | <built-in method update of dict object at 0x7763d8ed9f00> | Operating System |
| redhat | enterprise_linux_for_power_little_endian | 7.0 | <built-in method update of dict object at 0x77636c7cb680> | Operating System |
| redhat | enterprise_linux_for_power_little_endian | 8.0 | <built-in method update of dict object at 0x7763d8d024c0> | Operating System |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.1 | <built-in method update of dict object at 0x7763d8d02e40> | Operating System |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.2 | <built-in method update of dict object at 0x7763a1163c40> | Operating System |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.4 | <built-in method update of dict object at 0x7763a1126e00> | Operating System |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.6 | <built-in method update of dict object at 0x7763bb098840> | Operating System |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.8 | <built-in method update of dict object at 0x7763d8970900> | Operating System |
| redhat | enterprise_linux_for_scientific_computing | 7.0 | <built-in method update of dict object at 0x7763bb09bb80> | Operating System |
| redhat | enterprise_linux_server | 7.0 | <built-in method update of dict object at 0x7763d8d01380> | Operating System |
| redhat | enterprise_linux_server_aus | 7.2 | <built-in method update of dict object at 0x7763bbafe9c0> | Operating System |
| redhat | enterprise_linux_server_aus | 7.3 | <built-in method update of dict object at 0x7763d8d02940> | Operating System |
| redhat | enterprise_linux_server_aus | 7.4 | <built-in method update of dict object at 0x7763d8d00940> | Operating System |
| redhat | enterprise_linux_server_aus | 7.6 | <built-in method update of dict object at 0x7763d8eaf980> | Operating System |
| redhat | enterprise_linux_server_aus | 7.7 | <built-in method update of dict object at 0x7763bb73ab40> | Operating System |
| redhat | enterprise_linux_server_aus | 8.2 | <built-in method update of dict object at 0x77636c7cb940> | Operating System |
| redhat | enterprise_linux_server_aus | 8.4 | <built-in method update of dict object at 0x7763f0707bc0> | Operating System |
| redhat | enterprise_linux_server_aus | 8.6 | <built-in method update of dict object at 0x7763d8d03b80> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 7.6 | <built-in method update of dict object at 0x7763a1162400> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 7.7 | <built-in method update of dict object at 0x7763d8d03f40> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.1 | <built-in method update of dict object at 0x7763d8b89780> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.2 | <built-in method update of dict object at 0x7763d8d047c0> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.4 | <built-in method update of dict object at 0x7763d8a21c40> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.6 | <built-in method update of dict object at 0x7763ba5f1580> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.8 | <built-in method update of dict object at 0x77636c7ca400> | Operating System |
| redhat | enterprise_linux_server_tus | 7.6 | <built-in method update of dict object at 0x7763d862b940> | Operating System |
| redhat | enterprise_linux_server_tus | 7.7 | <built-in method update of dict object at 0x7763bbaff2c0> | Operating System |
| redhat | enterprise_linux_server_tus | 8.2 | <built-in method update of dict object at 0x7763a374e540> | Operating System |
| redhat | enterprise_linux_server_tus | 8.4 | <built-in method update of dict object at 0x7763ba5f26c0> | Operating System |
| redhat | enterprise_linux_server_tus | 8.6 | <built-in method update of dict object at 0x7763a1565540> | Operating System |
| redhat | enterprise_linux_server_tus | 8.8 | <built-in method update of dict object at 0x7763bbafecc0> | Operating System |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 7.6 | <built-in method update of dict object at 0x7763b90df340> | Operating System |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 7.7 | <built-in method update of dict object at 0x7763a11259c0> | Operating System |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.1 | <built-in method update of dict object at 0x7763d8b89fc0> | Operating System |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.2 | <built-in method update of dict object at 0x7763d8b88940> | Operating System |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.4 | <built-in method update of dict object at 0x7763d8a231c0> | Operating System |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.6 | <built-in method update of dict object at 0x77635fc2c440> | Operating System |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.8 | <built-in method update of dict object at 0x7763a3676c40> | Operating System |
| redhat | enterprise_linux_workstation | 7.0 | <built-in method update of dict object at 0x7763a067b380> | Operating System |
| redhat | jboss_core_services | 1.0 | <built-in method update of dict object at 0x7763a374d880> | Application |
| redhat | software_collections | 1.0 | <built-in method update of dict object at 0x7763a067a380> | Application |
| apache | http_server | * | <built-in method update of dict object at 0x7763a0679500> | Application |
| fedoraproject | fedora | 34 | <built-in method update of dict object at 0x7763a0678e80> | Operating System |
| fedoraproject | fedora | 35 | <built-in method update of dict object at 0x7763a067b640> | Operating System |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x7763a0679640> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7763a06780c0> | Operating System |
| debian | debian_linux | 11.0 | <built-in method update of dict object at 0x7763a067a300> | Operating System |
| netapp | cloud_backup | - | <built-in method update of dict object at 0x7763ba5f1fc0> | Application |
| netapp | clustered_data_ontap | - | <built-in method update of dict object at 0x7763ba5f1b40> | Application |
| netapp | storagegrid | - | <built-in method update of dict object at 0x7763ba5f2d80> | Application |
| broadcom | brocade_fabric_operating_system_firmware | - | <built-in method update of dict object at 0x7763ba5f3700> | Operating System |
| f5 | f5os | * | <built-in method update of dict object at 0x7763d8631d40> | Operating System |
| f5 | f5os | * | <built-in method update of dict object at 0x7763d8eaebc0> | Operating System |
| oracle | enterprise_manager_ops_center | 12.4.0.0 | <built-in method update of dict object at 0x7763bbbeffc0> | Application |
| oracle | http_server | 12.2.1.3.0 | <built-in method update of dict object at 0x7763bbbec200> | Application |
| oracle | http_server | 12.2.1.4.0 | <built-in method update of dict object at 0x7763bbbec480> | Application |
| oracle | instantis_enterprisetrack | 17.1 | <built-in method update of dict object at 0x7763bbbee580> | Application |
| oracle | instantis_enterprisetrack | 17.2 | <built-in method update of dict object at 0x7763bbbede40> | Application |
| oracle | instantis_enterprisetrack | 17.3 | <built-in method update of dict object at 0x7763bbbef940> | Application |
| oracle | secure_global_desktop | 5.6 | <built-in method update of dict object at 0x7763bbbedf40> | Application |
| oracle | zfs_storage_appliance_kit | 8.8 | <built-in method update of dict object at 0x7763bbbecb80> | Application |
| siemens | ruggedcom_nms | * | <built-in method update of dict object at 0x7763bbbeea00> | Application |
| siemens | sinec_nms | * | <built-in method update of dict object at 0x7763bbbefd80> | Application |
| siemens | sinema_remote_connect_server | * | <built-in method update of dict object at 0x7763bbbef600> | Application |
| siemens | sinema_remote_connect_server | 3.2 | <built-in method update of dict object at 0x7763bbbed300> | Application |
| siemens | sinema_server | 14.0 | <built-in method update of dict object at 0x7763bbbedc00> | Application |
| tenable | tenable.sc | * | <built-in method update of dict object at 0x7763bbbeeb40> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:resf:rocky_linux:8.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
| No | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* |
| No | cpe:2.3:o:redhat:enterprise_linux_server_workstation:7.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:f5:f5os:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:f5:f5os:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:secure_global_desktop:5.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:siemens:ruggedcom_nms:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:siemens:sinema_server:14.0:-:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* |