Unscored severity · published Jun 18, 2010
CVE-2010-2068
mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving…
–
CVSS
16%
EPSS
No
On KEV
Description
mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.
Exploitation
Is it being used?
Exploit prediction (EPSS)16.0% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HS
HTTP Server · Apache
2.2.9; 2.2.10; 2.2.11; 2.2.12; 2.2.13; 2.2.14; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2068
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2068
Patch
http://httpd.apache.org/security/vulnerabilities_22.html
lists.apple.com
http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
mail-archives.apache.org
http://mail-archives.apache.org/mod_mbox/httpd-announce/201006.mbox/%3C4C12933D.4060400%40apache.org%3E
marc.info
http://marc.info/?l=apache-announce&m=128009718610929&w=2
Vendor Advisory
http://secunia.com/advisories/40206
secunia.com
http://secunia.com/advisories/40824
More from HTTP Server
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
9.8
CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
9.1
CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
9.0
CVE-2021-40438
mod_proxy SSRF
7.8
CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability