Unscored severity · published Mar 5, 2010
CVE-2010-0425
modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure…
–
CVSS
94.2%
EPSS
No
On KEV
Description
modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."
Exploitation
Is it being used?
Exploit prediction (EPSS)94.2% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HS
HTTP Server · Apache
2.0.37 before 2.0.64; 2.2.0 before 2.2.15; 2.3.0 before 2.3.7 · source: NVD
VA
Vmware Ace Management Server · Broadcom
before 2.7.2 · source: NVD
WA
Websphere Application Server · Ibm
6.1 before 6.1.0.31 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-0425
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-0425
Vendor Advisory
http://httpd.apache.org/security/vulnerabilities_20.html
Vendor Advisory
http://httpd.apache.org/security/vulnerabilities_22.html
Broken Link
http://lists.vmware.com/pipermail/security-announce/2010/000105.html
Broken Link
http://secunia.com/advisories/38978
Broken Link
http://secunia.com/advisories/39628
Permissions Required
http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=917870&r2=917869&pathrev=917870
More from HTTP Server
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
9.8
CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
9.1
CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
9.0
CVE-2021-40438
mod_proxy SSRF
7.8
CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability