Home > Vulnerability Database > CVE-2011-4317

Mend.io Vulnerability Database

CVE-2011-4317

Date: November 29, 2011

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.

Language: C

Severity Score

3.7

Related Resources (38)

Url: https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Url: https://access.redhat.com/security/cve/CVE-2011-4317

Url: http://thread.gmane.org/gmane.comp.apache.devel/46440

Url: http://marc.info/?l=bugtraq&m=134987041210674&w=2

Url: http://marc.info/?l=bugtraq&m=133294460209056&w=2

Url: http://www.debian.org/security/2012/dsa-2405

Url: https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E

Url: https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

Url: https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

Url: http://rhn.redhat.com/errata/RHSA-2012-0128.html

Url: http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Url: https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

Url: https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E

Url: http://www.securitytracker.com/id?1026353

Url: https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E

Url: http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html

Url: http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html

Url: https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E

Url: http://secunia.com/advisories/48551

Url: https://bugzilla.redhat.com/show_bug.cgi?id=756483

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2011-4317

Url: https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2013:150

Url: https://security-tracker.debian.org/tracker/CVE-2011-4317

Url: https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

Url: https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

Url: https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

Url: http://kb.juniper.net/JSA10585

Url: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041

Url: https://nvd.nist.gov/vuln/detail/CVE-2011-4317

Url: http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2012:003

Url: http://support.apple.com/kb/HT5501

Url: https://community.qualys.com/blogs/securitylabs/2011/11/23/apache-reverse-proxy-bypass-issue

Url: https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

Url: https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E

Url: http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html

Url: https://www.mend.io/vulnerability-database/CVE-2011-4317

Severity Score

3.7

Weakness Type (CWE)

Input Validation

CWE-20

CVSS v3.1

Base Score:	3.7
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2011-4317

Date: November 29, 2011

Language: C

Severity Score

Related Resources (38)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?