CVE-2011-3368
05.10.2011, 22:55
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.Enginsight
| Vendor | Product | Version |
|---|---|---|
| apache | http_server | 1.3 |
| apache | http_server | 1.3.0 |
| apache | http_server | 1.3.1 |
| apache | http_server | 1.3.1.1 |
| apache | http_server | 1.3.2 |
| apache | http_server | 1.3.3 |
| apache | http_server | 1.3.4 |
| apache | http_server | 1.3.5 |
| apache | http_server | 1.3.6 |
| apache | http_server | 1.3.7 |
| apache | http_server | 1.3.8 |
| apache | http_server | 1.3.9 |
| apache | http_server | 1.3.10 |
| apache | http_server | 1.3.11 |
| apache | http_server | 1.3.12 |
| apache | http_server | 1.3.13 |
| apache | http_server | 1.3.14 |
| apache | http_server | 1.3.15 |
| apache | http_server | 1.3.16 |
| apache | http_server | 1.3.17 |
| apache | http_server | 1.3.18 |
| apache | http_server | 1.3.19 |
| apache | http_server | 1.3.20 |
| apache | http_server | 1.3.22 |
| apache | http_server | 1.3.23 |
| apache | http_server | 1.3.24 |
| apache | http_server | 1.3.25 |
| apache | http_server | 1.3.26 |
| apache | http_server | 1.3.27 |
| apache | http_server | 1.3.28 |
| apache | http_server | 1.3.29 |
| apache | http_server | 1.3.30 |
| apache | http_server | 1.3.31 |
| apache | http_server | 1.3.32 |
| apache | http_server | 1.3.33 |
| apache | http_server | 1.3.34 |
| apache | http_server | 1.3.35 |
| apache | http_server | 1.3.36 |
| apache | http_server | 1.3.37 |
| apache | http_server | 1.3.38 |
| apache | http_server | 1.3.39 |
| apache | http_server | 1.3.41 |
| apache | http_server | 1.3.42 |
| apache | http_server | 1.3.65 |
| apache | http_server | 1.3.68 |
| apache | http_server | 2.0 |
| apache | http_server | 2.0.9 |
| apache | http_server | 2.0.28 |
| apache | http_server | 2.0.28:beta |
| apache | http_server | 2.0.32 |
| apache | http_server | 2.0.32:beta |
| apache | http_server | 2.0.34:beta |
| apache | http_server | 2.0.35 |
| apache | http_server | 2.0.36 |
| apache | http_server | 2.0.37 |
| apache | http_server | 2.0.38 |
| apache | http_server | 2.0.39 |
| apache | http_server | 2.0.40 |
| apache | http_server | 2.0.41 |
| apache | http_server | 2.0.42 |
| apache | http_server | 2.0.43 |
| apache | http_server | 2.0.44 |
| apache | http_server | 2.0.45 |
| apache | http_server | 2.0.46 |
| apache | http_server | 2.0.47 |
| apache | http_server | 2.0.48 |
| apache | http_server | 2.0.49 |
| apache | http_server | 2.0.50 |
| apache | http_server | 2.0.51 |
| apache | http_server | 2.0.52 |
| apache | http_server | 2.0.53 |
| apache | http_server | 2.0.54 |
| apache | http_server | 2.0.55 |
| apache | http_server | 2.0.56 |
| apache | http_server | 2.0.57 |
| apache | http_server | 2.0.58 |
| apache | http_server | 2.0.59 |
| apache | http_server | 2.0.60 |
| apache | http_server | 2.0.61 |
| apache | http_server | 2.0.63 |
| apache | http_server | 2.0.64 |
| apache | http_server | 2.2.0 |
| apache | http_server | 2.2.1 |
| apache | http_server | 2.2.2 |
| apache | http_server | 2.2.3 |
| apache | http_server | 2.2.4 |
| apache | http_server | 2.2.6 |
| apache | http_server | 2.2.8 |
| apache | http_server | 2.2.9 |
| apache | http_server | 2.2.10 |
| apache | http_server | 2.2.11 |
| apache | http_server | 2.2.12 |
| apache | http_server | 2.2.13 |
| apache | http_server | 2.2.14 |
| apache | http_server | 2.2.15 |
| apache | http_server | 2.2.16 |
| apache | http_server | 2.2.18 |
| apache | http_server | 2.2.19 |
| apache | http_server | 2.2.20 |
| apache | http_server | 2.2.21 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References