A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVSS 3.x
| Source | Score | Severity | Vector | Exploitability | Impact |
|---|---|---|---|---|---|
| nvd@nist.gov | 9.0 | CRITICAL | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H | 2.2 | 6.0 |
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-918,CWE-918,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| redhat | enterprise_linux_for_power_little_endian_eus | 8.6 |
| redhat | enterprise_linux_server_tus | 8.6 |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.2 |
| oracle | enterprise_manager_ops_center | 12.4.0.0 |
| redhat | enterprise_linux_server_tus | 8.2 |
| resf | rocky_linux | 8.0 |
| redhat | enterprise_linux_server_tus | 7.6 |
| redhat | enterprise_linux_for_power_little_endian | 8.0 |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.4 |
| redhat | enterprise_linux_for_power_big_endian | 7.0 |
| redhat | enterprise_linux_for_ibm_z_systems | 7.0_s390x |
| netapp | clustered_data_ontap | - |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.1 |
| redhat | enterprise_linux_eus | 8.6 |
| redhat | enterprise_linux_workstation | 7.0 |
| redhat | enterprise_linux_eus | 8.8 |
| oracle | instantis_enterprisetrack | 17.2 |
| siemens | sinema_server | 14.0 |
| redhat | enterprise_linux_server_tus | 8.4 |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 7.6 |
| redhat | enterprise_linux_for_arm_64 | 8.0 |
| redhat | enterprise_linux_server_aus | 8.6 |
| netapp | cloud_backup | - |
| oracle | zfs_storage_appliance_kit | 8.8 |
| oracle | instantis_enterprisetrack | 17.1 |
| redhat | enterprise_linux_server_tus | 7.7 |
| redhat | enterprise_linux_for_scientific_computing | 7.0 |
| siemens | ruggedcom_nms | * |
| redhat | enterprise_linux_server_aus | 7.6 |
| debian | debian_linux | 11.0 |
| redhat | enterprise_linux_for_arm_64_eus | 8.8 |
| redhat | enterprise_linux_eus | 8.2 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.8 |
| redhat | enterprise_linux_for_ibm_z_systems_eus_s390x | 8.2 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.6 |
| redhat | enterprise_linux_eus | 8.1 |
| redhat | enterprise_linux_eus | 8.4 |
| redhat | jboss_core_services | 1.0 |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.8 |
| redhat | enterprise_linux_server_aus | 7.2 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.8 |
| siemens | sinema_remote_connect_server | * |
| debian | debian_linux | 9.0 |
| redhat | enterprise_linux_server_aus | 7.3 |
| oracle | http_server | 12.2.1.3.0 |
| redhat | enterprise_linux_server_aus | 8.2 |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 7.7 |
| oracle | secure_global_desktop | 5.6 |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.1 |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.8 |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 7.7 |
| redhat | enterprise_linux_for_arm_64_eus | 8.6 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.4 |
| siemens | sinema_remote_connect_server | 3.2 |
| redhat | enterprise_linux_server_aus | 7.7 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.2 |
| debian | debian_linux | 10.0 |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.4 |
| broadcom | brocade_fabric_operating_system_firmware | - |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.6 |
| redhat | enterprise_linux_server_aus | 7.4 |
| oracle | http_server | 12.2.1.4.0 |
| f5 | f5os | * |
| redhat | enterprise_linux_server | 7.0 |
| apache | http_server | * |
| redhat | enterprise_linux_server_aus | 8.4 |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.1 |
| redhat | enterprise_linux_for_power_little_endian | 7.0 |
| redhat | software_collections | 1.0 |
| redhat | enterprise_linux_server_tus | 8.8 |
| tenable | tenable.sc | * |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.1 |
| redhat | enterprise_linux_for_ibm_z_systems | 8.0 |
| fedoraproject | fedora | 35 |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.4 |
| netapp | storagegrid | - |
| oracle | instantis_enterprisetrack | 17.3 |
| fedoraproject | fedora | 34 |
| siemens | sinec_nms | * |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.2 |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 7.6 |