The vulnerability of the mod_proxy module in the Apache HTTP Server allows attackers to circumvent security restrictions.

The vulnerability of the modproxy module in the Apache HTTP Server is related to insufficient validation of data authenticity or the use of unreliable sources for processing X-Forwarded- headers. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

Tenable SecurityCenter 5.19.x / 5.20.x / 5.21.0 Multiple Vulnerabilities (TNS-2022-14)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is running 5.19.x, 5.20.x, or 5.21.0 and is therefore affected by multiple vulnerabilities: - The aprwrite function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an...

CLSA-2022-1656447241 Fixed CVEs in httpd: CVE-2022-31813, CVE-2022-28615, CVE-2022-26377

CVE-2022-26377: modproxyajp: fix HTTP request smuggling - CVE-2022-28615: fix possible out-of-bounds read in apstrcmpmatch - CVE-2022-31813: modproxy: preserve original request headers so an upstream knows what the original request hostname was, and so send X-Forwarded- headers correctly...

CLSA-2022-1656430723 Fixed CVEs in httpd: CVE-2022-28615, CVE-2022-31813, CVE-2022-26377

CVE-2022-26377: modproxyajp: fix HTTP request smuggling - CVE-2022-28615: fix possible out-of-bounds read in apstrcmpmatch - CVE-2022-31813: modproxy: preserve original request headers so an upstream knows what the original request hostname was, and so send X-Forwarded- headers correctly...

OESA-2022-1718 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Apache HTTP Server vulnerabilities (USN-5487-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5487-1 advisory. It was discovered that Apache HTTP Server modproxyajp incorrectly handled certain crafted request. A remote attacker...

SUSE SLES12 Security Update : apache2 (SUSE-SU-2022:2101-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2101-1 advisory. - Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows a...

Insecure Access Control

Apache HTTP Server has insecure access control. The vulnerability exists due to the system not sending the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism...

CVE-2022-32740

A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances...

UBUNTU-CVE-2022-32740

A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances...

CVE-2022-32740

A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances...

CVE-2022-32740

A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances...

Apache 2.4.x < 2.4.54 Multiple Vulnerabilities

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities: - Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker...

OTRS 安全漏洞

OTRS is an application from the German company OTRS. A service management software. A security vulnerability exists in OTRS versions 8.0.x through 8.0.23 and OTRS versions 7.0.x through 7.0.35, which stems from a third party's lack of protection of sensitive information in replies to forwarded...

Apache HTTP Server Data Forgery Issue Vulnerability (CNVD-2022-73123)

Apache HTTP Server is an open source web server from the Apache Foundation. Apache HTTP Server is vulnerable to a data forgery issue that stems from modproxy's X-Forwarded-For hop-by-hop mechanism discard. An attacker could use this vulnerability to bypass IP-based authentication on the source...

CVE-2022-31813

Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application...

CVE-2022-31813

Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application...

DEBIAN-CVE-2022-31813

Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application...

ALPINE-CVE-2022-31813

Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application...

Design/Logic Flaw

Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application...