CVE-2012-0053

MEDIUM 4.3

At a glance

Source: NVD
EPSS: EPSS 82.20 % · percentile 100 (2026-10-29)
State: PUBLISHED
Published: 2012-01-28 02:00 UTC
Updated: 2024-08-06 18:09 UTC
Assigner: redhat
NVD status: Modified

Search on…

Description

protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.

References

Scores

Version	Score	Vector	Scored by
CVSS 2.0	MEDIUM 4.3	AV:N/AC:M/Au:N/C:P/I:N/A:N	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2012-0092
GCVE · GCVE-0-2012-0053

CERT-FR advisories

CERTFR-2014-AVI-357 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
CERTA-2013-AVI-508 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
CERTA-2013-AVI-416 — Multiples vulnérabilités dans Oracle Solaris · cert.ssi.gouv.fr
CERTA-2012-AVI-512 — Multiples Vulnérabilités dans Apple OS X · cert.ssi.gouv.fr
CERTA-2012-AVI-358 — Multiples vulnérabilités dans HP System Management Homepage · cert.ssi.gouv.fr
CERTA-2012-AVI-316 — Multiples vulnérabilités dans HP Onboard Administrator · cert.ssi.gouv.fr
CERTA-2012-AVI-225 — Multiples vulnérabilités dans HP-UX · cert.ssi.gouv.fr
CERTA-2012-AVI-156 — Multiples vulnérabilités dans IBM HTTP Server · cert.ssi.gouv.fr
CERTA-2012-AVI-050 — Vulnérabilités dans Apache · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* ≥ 2.0.0 < 2.0.65
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* ≥ 2.2.0 < 2.2.22
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*
cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_web_server:1.0.0:*:*:*:*:*:*:*

Affected products

Product	Versions
	affected n/a

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 CVE-2012-0053