CVE-2021-35233

HTTP TRACK & TRACE Methods Enabled

Medium · published October 27, 2021

CVSS v3.1
5.3
EPSS
1%
Percentile
61.2
In the wild
Unconfirmed
What it is

The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was received in the response to the client. This may lead to the disclosure of sensitive information such as internal authentication headers appended by reverse proxies.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00960 · 61.2th percentile
Published
2021-10-27T00:51Z
EPSS history
Timeline
  • 27 OCT 00:51Z
    HTTP TRACK & TRACE Methods Enabled
    cvelistv5