#VU32827 Permissions, Privileges, and Access Controls in Apache HTTP Server - CVE-2012-0053

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32827

#VU32827 Permissions, Privileges, and Access Controls in Apache HTTP Server - CVE-2012-0053

Published: January 28, 2012 / Updated: July 29, 2020


Vulnerability identifier: #VU32827
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2012-0053
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
Apache HTTP Server
Software vendor:
Apache Foundation

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.


Remediation

Install update from vendor's website.

External links