Skip to main content

Improper Input Validation

CVE-2011-3368

Medium
5.3/10

Summary

The "mod_proxy" module in the Apache HTTP Server 1.3.x, 2.0.35 through 2.0.64, and 2.2.x prior to 2.2.22 does not properly interact with use of (1) "RewriteRule" and (2) "ProxyPassMatch" pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial "@" (at sign) character.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published