CVE-2011-3368

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1)…

published October 5, 2011

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.8th percentile for exploit probability.

CVSS
—
EPSS
91%
Percentile
99.8
In the wild
Unconfirmed
What it is

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.90734 · 99.8th percentile
Published
2011-10-05T22:00Z
EPSS history
Timeline
  • 05 OCT 22:00Z
    The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1)…
    cvelistv5