Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
httpdApache Team FoundationHTTPD:EB26BC6B6E566C865F53A311FC1A6744
HistoryOct 05, 2019 - 12:00 a.m.

Apache Httpd < 2.4.48 : mod_proxy_wstunnel tunneling of non Upgraded connections

2019-10-0500:00:00
Apache Team Foundation
httpd.apache.org
46

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.003

Percentile

68.5%

JSON

Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.

Affected configurations

Vulners
Node
apacheapache_httpdMatch2.4.46
OR
apacheapache_httpdMatch2.4.43
OR
apacheapache_httpdMatch2.4.41
OR
apacheapache_httpdMatch2.4.39
OR
apacheapache_httpdMatch2.4.38
OR
apacheapache_httpdMatch2.4.37
OR
apacheapache_httpdMatch2.4.35
OR
apacheapache_httpdMatch2.4.34
OR
apacheapache_httpdMatch2.4.33
OR
apacheapache_httpdMatch2.4.29
OR
apacheapache_httpdMatch2.4.28
OR
apacheapache_httpdMatch2.4.27
OR
apacheapache_httpdMatch2.4.26
OR
apacheapache_httpdMatch2.4.25
OR
apacheapache_httpdMatch2.4.23
OR
apacheapache_httpdMatch2.4.20
OR
apacheapache_httpdMatch2.4.18
OR
apacheapache_httpdMatch2.4.17
OR
apacheapache_httpdMatch2.4.16
OR
apacheapache_httpdMatch2.4.12
OR
apacheapache_httpdMatch2.4.10
OR
apacheapache_httpdMatch2.4.9
OR
apacheapache_httpdMatch2.4.7
OR
apacheapache_httpdMatch2.4.6
VendorProductVersionCPE
apacheapache_httpd2.4.46cpe:2.3:a:apache:apache_httpd:2.4.46:*:*:*:*:*:*:*
apacheapache_httpd2.4.43cpe:2.3:a:apache:apache_httpd:2.4.43:*:*:*:*:*:*:*
apacheapache_httpd2.4.41cpe:2.3:a:apache:apache_httpd:2.4.41:*:*:*:*:*:*:*
apacheapache_httpd2.4.39cpe:2.3:a:apache:apache_httpd:2.4.39:*:*:*:*:*:*:*
apacheapache_httpd2.4.38cpe:2.3:a:apache:apache_httpd:2.4.38:*:*:*:*:*:*:*
apacheapache_httpd2.4.37cpe:2.3:a:apache:apache_httpd:2.4.37:*:*:*:*:*:*:*
apacheapache_httpd2.4.35cpe:2.3:a:apache:apache_httpd:2.4.35:*:*:*:*:*:*:*
apacheapache_httpd2.4.34cpe:2.3:a:apache:apache_httpd:2.4.34:*:*:*:*:*:*:*
apacheapache_httpd2.4.33cpe:2.3:a:apache:apache_httpd:2.4.33:*:*:*:*:*:*:*
apacheapache_httpd2.4.29cpe:2.3:a:apache:apache_httpd:2.4.29:*:*:*:*:*:*:*
Rows per page:
1-10 of 241

Related

debiancve 1
openvas 7
nvd 1
cve 1
veracode 1
cbl_mariner 2
prion 1
redhatcve 1
f5 1
nessus 16
cvelist 1
osv 2
ubuntucve 2
photon 5
ibm 2
debian 1
gentoo 1
mageia 1
slackware 1
amazon 3
kaspersky 1
freebsd 1
fedora 2
redhat 2
oracle 1
debiancve
debiancve
CVE-2019-17567
2021-06-10 07:15:07
openvas
openvas
Apache HTTP Server 2.4.6 - 2.4.46 Tunneling Misconfiguration Vulnerability - Linux
2021-06-10 00:00:00
Apache HTTP Server 2.4.6 - 2.4.46 Tunneling Misconfiguration Vulnerability - Windows
2021-06-10 00:00:00
Slackware: Security Advisory (SSA:2021-158-01)
2022-04-21 00:00:00
nvd
nvd
CVE-2019-17567
2021-06-10 07:15:07
cve
cve
CVE-2019-17567
2021-06-10 07:15:07
veracode
veracode
Privilege Escalation
2021-07-11 18:17:25
cbl_mariner
cbl_mariner
CVE-2019-17567 affecting package httpd for versions less than 2.4.52-1
2022-04-09 06:51:57
CVE-2019-17567 affecting package httpd 2.4.46-6
2021-10-15 04:46:31
prion
prion
Authentication flaw
2021-06-10 07:15:00
redhatcve
redhatcve
CVE-2019-17567
2021-06-08 03:49:47
f5
f5
K000133522 : Apache mod_proxy_wstunnel vulnerability CVE-2019-17567
2023-04-14 00:00:00
nessus
nessus
CBL Mariner 2.0 Security Update: httpd (CVE-2019-17567)
2023-03-20 00:00:00
RHEL 8 : httpd (Unpatched Vulnerability)
2024-06-03 00:00:00
Photon OS 3.0: Httpd PHSA-2021-3.0-0257
2021-09-09 00:00:00
cvelist
cvelist
CVE-2019-17567 mod_proxy_wstunnel tunneling of non Upgraded connections
2021-06-10 07:10:19
osv
osv
CVE-2019-17567
2021-06-10 07:15:07
apache2 - security update
2024-05-24 00:00:00
ubuntucve
ubuntucve
CVE-2019-17567
2021-06-10 00:00:00
CVE-2020-13950
2021-06-10 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2021-0257
2021-06-22 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2021-2.0-0365
2021-06-30 00:00:00
Important Photon OS Security Update - PHSA-2021-3.0-0257
2021-06-22 00:00:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities in Apache HTTP Server affect IBM i
2021-09-24 22:34:57
Security Bulletin: IBM Rational Build Forge 8.0.x is affected by Apache HTTP Server version used in it. (CVE-2021-31618, CVE-2020-13950, CVE-2019-17567, CVE-2020-26691, CVE-2021-26690, CVE-2020-13938, CVE-2021-30641, CVE-2020-35452)
2022-01-17 18:35:14
debian
debian
[SECURITY] [DLA 3818-1] apache2 security update
2024-05-25 11:06:45
gentoo
gentoo
Apache: Multiple vulnerabilities
2021-07-17 00:00:00
mageia
mageia
Updated apache packages fix security vulnerabilities
2021-06-16 23:22:25
slackware
slackware
[slackware-security] httpd
2021-06-07 19:07:12
amazon
amazon
Medium: httpd
2021-07-01 00:59:00
Medium: httpd24
2021-07-08 18:38:00
Important: httpd
2021-06-16 20:37:00
kaspersky
kaspersky
KLA12369 Multiple vulnerabilities in Apache HTTP Server
2021-06-01 00:00:00
freebsd
freebsd
Apache httpd -- Multiple vulnerabilities
2021-06-09 00:00:00
fedora
fedora
[SECURITY] Fedora 34 Update: httpd-2.4.49-1.fc34
2021-09-20 13:58:04
[SECURITY] Fedora 35 Update: httpd-2.4.49-1.fc35
2021-09-24 20:56:12
redhat
redhat
(RHSA-2021:4614) Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update
2021-11-10 17:10:19
(RHSA-2021:4613) Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update
2021-11-10 17:09:50
oracle
oracle
Oracle Critical Patch Update Advisory - October 2021
2021-10-19 00:00:00

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.003

Percentile

68.5%

JSON
Related for HTTPD:EB26BC6B6E566C865F53A311FC1A6744
debiancve1openvas7nvd1cve1veracode1cbl_mariner2prion1redhatcve1f51nessus16cvelist1osv2ubuntucve2photon5ibm2debian1gentoo1mageia1slackware1amazon3kaspersky1freebsd1fedora2redhat2oracle1