Input validation error in Apache HTTP Server - CVE-2015-3183

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33821

Input validation error in Apache HTTP Server - CVE-2015-3183

Published: July 21, 2015 / Updated: August 4, 2020


Vulnerability identifier: #VU33821
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2015-3183
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Apache Foundation
Affected software:
Apache HTTP Server

Detailed vulnerability description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.


How to mitigate CVE-2015-3183

Install update from vendor's website.

Sources