// For flags

CVE-2011-3348

httpd: mod_proxy_ajp remote temporary DoS

Severity Score

4.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.

El módulo mod_proxy_ajp en el Apache HTTP Server antes de v2.2.21, cuando se usa con mod_proxy_balancer en algunas configuraciones, permite a atacantes remotos provocar una denegación de servicio ("error state" temporal en el "back-end" del servidor) a través de una petición HTTP mal formada.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2011-08-30 CVE Reserved
  • 2011-09-19 CVE Published
  • 2024-03-19 EPSS Updated
  • 2024-08-06 CVE Updated
  • 2024-08-06 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-400: Uncontrolled Resource Consumption
CAPEC
References (32)
URL Tag Source
http://support.apple.com/kb/HT5130 Third Party Advisory
http://www.apache.org/dist/httpd/Announcement2.2.html Broken Link
http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html Third Party Advisory
http://www.securityfocus.com/bid/49616 Third Party Advisory
http://www.securitytracker.com/id?1026054 Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/69804 Third Party Advisory
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14941 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18154 Signature
URL Date SRC
http://community.jboss.org/message/625307 2024-08-06
URL Date SRC
URL Date SRC
http://httpd.apache.org/security/vulnerabilities_22.html#2.2.21 2023-11-07
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html 2023-11-07
http://marc.info/?l=bugtraq&m=131731002122529&w=2 2023-11-07
http://marc.info/?l=bugtraq&m=132033751509019&w=2 2023-11-07
http://rhn.redhat.com/errata/RHSA-2012-0542.html 2023-11-07
http://rhn.redhat.com/errata/RHSA-2012-0543.html 2023-11-07
http://secunia.com/advisories/46013 2023-11-07
http://www.mandriva.com/security/advisories?name=MDVSA-2011:168 2023-11-07
http://www.redhat.com/support/errata/RHSA-2011-1391.html 2023-11-07
https://access.redhat.com/security/cve/CVE-2011-3348 2012-05-07
https://bugzilla.redhat.com/show_bug.cgi?id=736690 2012-05-07
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Redhat
Search vendor "Redhat"
 Jboss Enterprise Web Server
Search vendor "Redhat" for product "Jboss Enterprise Web Server"
 1.0.0
Search vendor "Redhat" for product "Jboss Enterprise Web Server" and version "1.0.0"
-
Affected
in Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
 6.0
Search vendor "Redhat" for product "Enterprise Linux" and version "6.0"
-
Safe
Redhat
Search vendor "Redhat"
 Jboss Enterprise Web Server
Search vendor "Redhat" for product "Jboss Enterprise Web Server"
 1.0.0
Search vendor "Redhat" for product "Jboss Enterprise Web Server" and version "1.0.0"
-
Affected
in Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
 7.0
Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"
-
Safe
Apache
Search vendor "Apache"
 Http Server
Search vendor "Apache" for product "Http Server"
 >= 2.2.12 <= 2.2.20
Search vendor "Apache" for product "Http Server" and version " >= 2.2.12 <= 2.2.20"
-
Affected