NVD

Id
10785  
Name
CVE-2011-4317  
Description
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2011-11-29  
Modified Date
2016-06-16  
Seq
2011-4317  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
60602 10785 CVE-2011-4317 SSRT100877  View
60603 10785 CVE-2011-4317 http://kb.juniper.net/JSA10585  View
60604 10785 CVE-2011-4317 APPLE-SA-2012-09-19-2  View
60605 10785 CVE-2011-4317 openSUSE-SU-2013:0243  View
60606 10785 CVE-2011-4317 openSUSE-SU-2013:0248  View
60607 10785 CVE-2011-4317 SSRT100966  View
60608 10785 CVE-2011-4317 RHSA-2012:0128  View
60609 10785 CVE-2011-4317 http://support.apple.com/kb/HT5501  View
60610 10785 CVE-2011-4317 http://thread.gmane.org/gmane.comp.apache.devel/46440  View
60611 10785 CVE-2011-4317 MDVSA-2012:003  View
60612 10785 CVE-2011-4317 MDVSA-2013:150  View
60613 10785 CVE-2011-4317 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html  View
60614 10785 CVE-2011-4317 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html  View
60615 10785 CVE-2011-4317 1026353  View
60616 10785 CVE-2011-4317 https://bugzilla.redhat.com/show_bug.cgi?id=756483  View
60617 10785 CVE-2011-4317 https://community.qualys.com/blogs/securitylabs/2011/11/23/apache-reverse-proxy-bypass-issue  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
32932 JVNDB-2011-003172 Apache HTTP Server の mod_proxy モジュールにおけるイントラネットサーバにリクエストを送信される脆弱性 Apache HTTP Server の mod_proxy モジュールは、リビジョン 1179239 パッチが適用されているとき、リバースプロキシの設定に対しての (1) RewriteRule、および (2) ProxyPassMatch のパターンマッチを適切に処理しないため、イントラネットサーバにリクエストを送信される脆弱性が存在します。 CVE-2011-4317 52224 CVE-2011-4317 10785 4.3 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-003172.html 2011-11-30 2015-01-30 View