Published: 20/07/2015 Updated: 14/12/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

The chunked transfer coding implementation in the Apache HTTP Server prior to 2.4.14 does not properly parse chunk headers, which allows remote malicious users to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache http server

Several security issues were fixed in the Apache HTTP server ...

Synopsis Moderate: Red Hat JBoss Enterprise Application Platform 6410 natives update on RHEL 7 Type/Severity Security Advisory: Moderate Topic Updated packages that provide Red Hat JBoss Enterprise Application Platform 6410 natives, fix several bugs, and add various enhancements are now available for Re ...

Synopsis Moderate: Red Hat JBoss Web Server 302 security update Type/Severity Security Advisory: Moderate Topic Updated Red Hat JBoss Web Server 302 packages are now available for RedHat Enterprise Linux 6Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerabi ...

Synopsis Moderate: Red Hat JBoss Enterprise Application Platform 6410 natives update on RHEL 6 Type/Severity Security Advisory: Moderate Topic Updated packages that provide Red Hat JBoss Enterprise Application Platform 6410 natives, fix several bugs, and add various enhancements are now available for Re ...

Synopsis Moderate: Red Hat JBoss Web Server 302 security update Type/Severity Security Advisory: Moderate Topic Updated Red Hat JBoss Web Server 302 packages are now available for RedHat Enterprise Linux 7Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerabi ...

Several vulnerabilities have been found in the Apache HTTPD server CVE-2015-3183 An HTTP request smuggling attack was possible due to a bug in parsing of chunked requests A malicious client could force the server to misinterpret the request length, allowing cache poisoning or credential hijacking if an intermediary proxy is in us ...

It was discovered that in httpd 24, the internal API function ap_some_auth_required() could incorrectly indicate that a request was authenticated even when no authentication was used An httpd module using this API function could consequently allow access that should have been denied (CVE-2015-3185) Multiple flaws were found in the way httpd pars ...

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks ...

Tenable SecurityCenter is potentially impacted by two vulnerabilities in Apache HTTP Server CVE-2015-3183: The chunked transfer coding implementation in the Apache HTTP Server before 2414 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling o ...

nasl plugin tokenizer and information extraction

nasltokens nasltokens is a utility to extract information from NASL plugins, and generate an intermediate JSON policy file consumable by other tools for vulnerability analysis The format used is the intermediate scribe vulnerability policy format NASL plugins that focus on authenticate package tests are supported Usage Typical usage involves conversion of a NASL plugin file

Get Started

CVE-2015-3183

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect