5.1
CVSSv2

CVE-2013-1862

Published: 10/06/2013 Updated: 14/09/2022
CVSS v2 Base Score: 5.1 | Impact Score: 6.4 | Exploitability Score: 4.9
VMScore: 457
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P

Vulnerability Summary

mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x prior to 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote malicious users to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache http server

redhat jboss_enterprise_application_platform 6.0.0

redhat jboss_enterprise_application_platform 6.4.0

oracle http server 12.1.3.0

oracle http server 12.1.2.0

oracle http server 11.1.1.7.0

oracle http server 10.1.3.5.0

redhat enterprise linux server 5.0

redhat enterprise linux workstation 5.0

redhat enterprise linux server aus 6.4

redhat enterprise linux desktop 6.0

redhat enterprise linux server 6.0

redhat enterprise linux workstation 6.0

redhat enterprise linux desktop 5.0

redhat enterprise linux server aus 5.9

redhat enterprise linux eus 5.9

redhat enterprise linux eus 6.4

canonical ubuntu linux 13.04

canonical ubuntu linux 12.10

canonical ubuntu linux 10.04

canonical ubuntu linux 12.04

opensuse opensuse 12.3

opensuse opensuse 11.4

opensuse opensuse 12.2

Vendor Advisories

Synopsis Moderate: httpd security update Type/Severity Security Advisory: Moderate Topic Updated httpd packages that fix multiple security issues are now availablefor Red Hat Enterprise Linux 5 and 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerabi ...
Synopsis Moderate: Red Hat JBoss Enterprise Application Platform 611 update Type/Severity Security Advisory: Moderate Topic Red Hat JBoss Enterprise Application Platform 611, which fixes multiplesecurity issues, various bugs, and adds enhancements, is now available forRed Hat Enterprise Linux 5The Red ...
Debian Bug report logs - #717272 apache2: Fix for CVE-2013-1896 Package: apache2; Maintainer for apache2 is Debian Apache Maintainers <debian-apache@listsdebianorg>; Source for apache2 is src:apache2 (PTS, buildd, popcon) Reported by: Marc Deslauriers <marcdeslauriers@ubuntucom> Date: Thu, 18 Jul 2013 17:00:06 UT ...
Several security issues were fixed in the Apache HTTP Server ...
Synopsis Moderate: Red Hat JBoss Enterprise Application Platform 611 update Type/Severity Security Advisory: Moderate Topic Red Hat JBoss Enterprise Application Platform 611, which fixes multiplesecurity issues, various bugs, and adds enhancements, is now available forRed Hat Enterprise Linux 6The Red ...
mod_rewritec in the mod_rewrite module in the Apache HTTP Server 22x before 2225 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator ...
Cross-site scripting (XSS) flaws were found in the mod_proxy_balancer module's manager web interface If a remote attacker could trick a user, who was logged into the manager web interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's manager interface session (CVE-2012-4558) I ...
Cross-site scripting (XSS) flaws were found in the mod_proxy_balancer module's manager web interface If a remote attacker could trick a user, who was logged into the manager web interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's manager interface session (CVE-2012-4558) I ...

Github Repositories

Network reconnaissance and vulnerability assessment tools.

ReconScan The purpose of this project is to develop scripts that can be useful in the pentesting workflow, be it for VulnHub VMs, CTFs, hands-on certificates, or real-world targets The project currently consists of two major components: a script invoking and aggregating the results of existing tools, and a second script for automated analysis of the aforementioned results from

Network reconnaissance and vulnerability assessment tools.

ReconScan The purpose of this project is to develop scripts that can be useful in the pentesting workflow, be it for VulnHub VMs, CTFs, hands-on certificates, or real-world targets The project currently consists of two major components: a script invoking and aggregating the results of existing tools, and a second script for automated analysis of the aforementioned results from

repository ini digunakan untuk belajar

ReconScan The purpose of this project is to develop scripts that can be useful in the pentesting workflow, be it for VulnHub VMs, CTFs, hands-on certificates, or real-world targets The project currently consists of two major components: a script invoking and aggregating the results of existing tools, and a second script for automated analysis of the aforementioned results from

Network reconnaissance and vulnerability assessment tools.

ReconScan The purpose of this project is to develop scripts that can be useful in the pentesting workflow, be it for VulnHub VMs, CTFs, hands-on certificates, or real-world targets The project currently consists of two major components: a script invoking and aggregating the results of existing tools, and a second script for automated analysis of the aforementioned results from

DC 1: Vulnhub Walkthrough Scanning nmap 192168122184 nmap -sV -A 192168122184 (service version scan) nmap -sV -A --script vuln 192168122184 (Vulnerability scan) root@kali:~# **nmap -sV -A 192168122184** Starting Nmap 780SVN ( nmaporg ) at 2021-05-27 02:58 EDT Stats: 0:00:17 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan NSE Timing: About 973

internetdb Fast IP Lookups for Open Ports and Vulnerabilities Description Shodan shodanio/ scans the internet for hosts and services and maintains a few APIs into that data One API is the InternetDB internetdbshodanio/, which allows for free querying of open ports and vulnerabilities Tools are provided to query this servce What’s Inside The Tin The f

pigat ( Passive Intelligence Gathering Aggregation Tool ) 被动信息收集聚合工具

Pigat:一款被动信息收集聚合工具 前言 Pigat(Passive Intelligence Gathering Aggregation Tool)被动信息收集聚合工具,该工具通过爬取目标URL在第三方网站比如备案查询网站、子域名查询网站的结果来对目标进行被动信息收集。 开发此工具的初衷就是平时在使用一些第三方的网站进行目标信息收

Strike A python tool to quickly analyze all IPs and see which ones have open ports and vulnerabilities Installation apt-get install python3 git clone githubcom/SecureAxom/strike cd strike pip3 install -r requirementstxt python3 strikepy Usages python3 strikepy -h python3 strikepy -t 20891

Pigat:一款被动信息收集聚合工具 前言 Pigat(Passive Intelligence Gathering Aggregation Tool)被动信息收集聚合工具,该工具通过爬取目标URL在第三方网站比如备案查询网站、子域名查询网站的结果来对目标进行被动信息收集。 开发此工具的初衷就是平时在使用一些第三方的网站进行目标信息收

References

NVD-CWE-noinfohttp://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patchhttp://svn.apache.org/viewvc?view=revision&revision=r1469311https://bugzilla.redhat.com/show_bug.cgi?id=953729http://rhn.redhat.com/errata/RHSA-2013-0815.htmlhttp://lists.opensuse.org/opensuse-updates/2013-08/msg00026.htmlhttp://www.ubuntu.com/usn/USN-1903-1http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.htmlhttp://lists.opensuse.org/opensuse-updates/2013-08/msg00030.htmlhttp://www-01.ibm.com/support/docview.wss?uid=swg21644047http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1862https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetokenhttp://rhn.redhat.com/errata/RHSA-2013-1209.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1207.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1208.htmlhttp://secunia.com/advisories/55032http://www.securityfocus.com/bid/64758http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2013:174http://support.apple.com/kb/HT6150http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.htmlhttp://www.securityfocus.com/bid/59826https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19534https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18790https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10@%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3Ehttps://access.redhat.com/errata/RHSA-2013:0815https://nvd.nist.govhttps://usn.ubuntu.com/1903-1/https://access.redhat.com/security/cve/cve-2013-1862https://www.securityfocus.com/bid/59826http://tools.cisco.com/security/center/viewAlert.x?alertId=32440