Login Request a demo
Unscored severity · published Jan 28, 2012
CVE-2012-0053
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows…
–
CVSS
82.2%
EPSS
No
On KEV
Description
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
Exploitation
Is it being used?
Exploit prediction (EPSS)82.2% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HS
HTTP Server · Apache
2.0.0 before 2.0.65; 2.2.0 before 2.2.22 · source: NVD
DL
Debian Linux · Debian
5.0; 6.0; 7.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
6.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
6.2 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0 · source: NVD
JE
Jboss Enterprise Web Server · Redhat
1.0.0 · source: NVD
LE
Linux Enterprise Server · Suse
10 · source: NVD
LE
Linux Enterprise Software Development Kit · Suse
10 · source: NVD
OP
Opensuse · Opensuse
11.4 · source: NVD
ST
Storage · Redhat
2.0 · source: NVD
Affected product
HS
HTTP Server
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-0053
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-0053
Broken Link
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
Vendor Advisory
http://httpd.apache.org/security/vulnerabilities_22.html
Third Party Advisory
http://kb.juniper.net/JSA10585
Broken Link
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html
More from HTTP Server
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
9.8
CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
9.1
CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
9.0
CVE-2021-40438
mod_proxy SSRF
7.8
CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability