#VU33821 Input validation error in Apache HTTP Server - CVE-2015-3183

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33821

#VU33821 Input validation error in Apache HTTP Server - CVE-2015-3183

Published: July 21, 2015 / Updated: August 4, 2020


Vulnerability identifier: #VU33821
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2015-3183
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Apache HTTP Server
Software vendor:
Apache Foundation

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.


Remediation

Install update from vendor's website.

External links