Executive Summary

Informations
Name CVE-2023-25690 First vendor Publication 2023-03-07
Vendor Cve Last vendor Modification 2025-02-13

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Overall CVSS Score 9.8
Base Score 9.8 Environmental Score 9.8
impact SubScore 5.9 Temporal Score 9.8
Exploitabality Sub Score 3.9
 
Attack Vector Network Attack Complexity Low
Privileges Required None User Interaction None
Scope Unchanged Confidentiality Impact High
Integrity Impact High Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.

Configurations are affected when mod_proxy is enabled along with some form of RewriteRule
or ProxyPassMatch in which a non-specific pattern matches
some portion of the user-supplied request-target (URL) data and is then
re-inserted into the proxied request-target using variable substitution. For example, something like:

RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/

Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25690

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 253

Sources (Detail)

http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Requ...
https://httpd.apache.org/security/vulnerabilities_24.html
https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html
https://security.gentoo.org/glsa/202309-01
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Date Informations
2025-02-13 21:21:59
  • Multiple Updates
2024-11-28 14:22:44
  • Multiple Updates
2024-08-02 13:46:24
  • Multiple Updates
2024-08-02 01:32:26
  • Multiple Updates
2024-02-02 02:43:42
  • Multiple Updates
2024-02-01 12:29:31
  • Multiple Updates
2024-01-02 21:27:35
  • Multiple Updates
2023-09-09 05:27:43
  • Multiple Updates
2023-09-05 13:39:16
  • Multiple Updates
2023-09-05 01:28:46
  • Multiple Updates
2023-09-02 13:37:30
  • Multiple Updates
2023-09-02 01:29:15
  • Multiple Updates
2023-08-12 13:42:58
  • Multiple Updates
2023-08-12 01:28:29
  • Multiple Updates
2023-08-11 13:34:10
  • Multiple Updates
2023-08-11 01:29:21
  • Multiple Updates
2023-08-06 13:31:30
  • Multiple Updates
2023-08-06 01:28:08
  • Multiple Updates
2023-08-04 13:31:58
  • Multiple Updates
2023-08-04 01:28:31
  • Multiple Updates
2023-07-14 13:31:45
  • Multiple Updates
2023-07-14 01:28:08
  • Multiple Updates
2023-04-25 09:27:34
  • Multiple Updates
2023-03-29 02:30:12
  • Multiple Updates
2023-03-28 12:27:51
  • Multiple Updates
2023-03-14 17:27:20
  • Multiple Updates
2023-03-07 21:27:18
  • First insertion