Unscored severity · published Aug 5, 2010
CVE-2010-2791
mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent…
–
CVSS
8.3%
EPSS
No
On KEV
Description
mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.3% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HS
HTTP Server · Apache
2.2.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2791
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2791
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
www.openwall.com
http://www.openwall.com/lists/oss-security/2010/07/30/1
www.oracle.com
http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
www.redhat.com
http://www.redhat.com/support/errata/RHSA-2010-0659.html
www.securityfocus.com
http://www.securityfocus.com/bid/42102
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/60883
More from HTTP Server
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
9.8
CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
9.1
CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
9.0
CVE-2021-40438
mod_proxy SSRF
7.8
CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability