{"id":"CVE-2011-3368","published":"2011-10-05T22:00:00Z","modified":"2024-08-06T23:29:56Z","title":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.","provenance":"source","from":"CVE.org"},"summary":{"text":"The mod_proxy module in Apache HTTP Server versions 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly handle RewriteRule and ProxyPassMatch pattern matches used to configure a reverse proxy. An attacker who can send a request containing a malformed URI with an initial @ character can cause the server to forward requests to intranet servers.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:15:09Z"},"cvss":null,"epss":{"score":0.90734,"percentile":0.99803,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":3,"pulses":[{"name":"Python: OVSAgentServer Document (autofilled name)","url":"https://otx.alienvault.com/pulse/6660c1268a1f430e17236b55","created":"2024-06-05"},{"name":"UPX executable packer.","url":"https://otx.alienvault.com/pulse/663d2869e0f3a42bbddc42ff","created":"2024-05-09"},{"name":"Internal CVE Research","url":"https://otx.alienvault.com/pulse/6228b4f0b2d5ade72cc7a0ea","created":"2022-03-09"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://web.archiveorange.com/archive/v/ZyS0hzECD5zzb2NkvQlt","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1179239","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=134987041210674&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.contextis.com/research/blog/reverseproxybypass/","tags":["x_refsource_MISC"]},{"url":"http://seclists.org/fulldisclosure/2011/Oct/273","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-1391.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=nas2b7c57b1f1035675186257927003c8d48","tags":["vendor-advisory","x_refsource_AIXAPAR"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0543.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://secunia.com/advisories/46288","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://osvdb.org/76079","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://www.exploit-db.com/exploits/17969","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://marc.info/?l=bugtraq&m=133294460209056&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/49957","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=nas2064c7e5f53452ff686257927003c8d42","tags":["vendor-advisory","x_refsource_AIXAPAR"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0542.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"http://support.apple.com/kb/HT5501","tags":["x_refsource_CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/70336","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html","tags":["x_refsource_CONFIRM"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=740045","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id?1026144","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-1392.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://seclists.org/fulldisclosure/2011/Oct/232","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:144","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://secunia.com/advisories/46414","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/48551","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.debian.org/security/2012/dsa-2405","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://kb.juniper.net/JSA10585","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2011-3332","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2011-3332","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":17969,"url":"https://www.exploit-db.com/exploits/17969","title":"Apache mod_proxy - Reverse Proxy Exposure","type":"remote","platform":"multiple","date":"2011-10-11","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2011-10-11"},"pocGithub":{"count":2,"skipped":0,"earliest":"2017-04-18","earliestUrl":"https://github.com/SECFORCE/CVE-2011-3368","repos":[{"name":"SECFORCE/CVE-2011-3368","url":"https://github.com/SECFORCE/CVE-2011-3368","stars":1,"created":"2017-04-18"},{"name":"colorblindpentester/CVE-2011-3368","url":"https://github.com/colorblindpentester/CVE-2011-3368","stars":0,"created":"2019-03-22"}]},"metasploit":[{"name":"Apache Reverse Proxy Bypass Vulnerability Scanner","module":"auxiliary/scanner/http/rewrite_proxy_bypass","type":"auxiliary","disclosureDate":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/rewrite_proxy_bypass.rb"}],"first":{"date":"2011-10-11","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/17969"},"provenance":"source"},"exploitRefs":["http://www.exploit-db.com/exploits/17969"],"flow":[],"timeline":[{"date":"2011-10-05","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2011-3368","provenance":"source"},{"date":"2011-10-11","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-17969); later: PoC-in-GitHub 2017-04-18","url":"https://www.exploit-db.com/exploits/17969","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":26.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9980"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 2 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-cve-2011-3368-family-cve-2011-3368","children":[{"from":"CVE-2011-3368","to":"CVE-2011-3639","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.","from":"CVE.org","in":"CVE-2011-3639"}]},{"from":"CVE-2011-3368","to":"CVE-2011-4317","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.","from":"CVE.org","in":"CVE-2011-4317"}]}]}}