Lucene search

K
cve[email protected]CVE-2012-2213
HistoryOct 03, 2022 - 4:15 p.m.

CVE-2012-2213

2022-10-0316:15:36
CWE-264
web.nvd.nist.gov
27
cve-2012-2213
squid
remote attackers
bypass
access configuration
connect method
host http header
nvd

6.9 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

67.8%

Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and the observed behavior is consistent with a squid.conf file that was (perhaps inadvertently) designed to allow access based on a β€œreq_header Host” acl regex that matches www.uol.com.br

Affected configurations

NVD
Node
squid-cachesquidMatch3.1.9

6.9 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

67.8%