Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2019-17567

mod_proxy_wstunnel tunneling of non Upgraded connections

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache HTTP Server

  • 2.4.46affected
  • 2.4.43affected
  • 2.4.41affected
  • 2.4.39affected
  • 2.4.38affected
  • 2.4.37affected
  • 2.4.35affected
  • 2.4.34affected
  • 2.4.33affected
  • 2.4.29affected
  • 2.4.28affected
  • 2.4.27affected
  • 2.4.26affected
  • 2.4.25affected
  • 2.4.23affected
  • 2.4.20affected
  • 2.4.18affected
  • 2.4.17affected
  • 2.4.16affected
  • 2.4.12affected
  • 2.4.10affected
  • 2.4.9affected
  • 2.4.7affected
  • 2.4.6affected

References