The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.

According to its banner, the version of Apache 2.4.x running on the remote host is prior 2.4.3. It is, therefore, affected by the following vulnerabilities :

 - An input validation error exists related to 'mod_negotiation', 'Multiviews' and untrusted uploads that can allow cross-site scripting attacks. (CVE-2012-2687)

 - An error exists related to 'mod_proxy_ajp' and 'mod_proxy_http' that can allow connections to remain open. This condition can allow information disclosure when combined with specially crafted requests. (CVE-2012-3502)

Note that the scanner did not actually test for these issues, but instead has relied on the version in the server's banner.

The remote host is running a Apache HTTP server. 

Versions 2.4.1 and 2.4.2 are vulnerable to the following vulnerabilities :

  - An input validation error exists related to 'mod_negotiation', 'Multiviews' and untrusted uploads that can allow cross-site scripting attacks. (CVE-2012-2687)

  - An error exists related to 'mod_proxy_ajp' and 'mod_proxy_http' that can allow connections to remain open. This condition can allow information disclosure when combined with specially crafted requests. (CVE-2012-3502)

According to its banner, the version of Apache 2.4.x running on the remote host is prior 2.4.3. It is, therefore, affected by the following vulnerabilities :

  - An input validation error exists related to     'mod_negotiation', 'Multiviews' and untrusted uploads     that can allow cross-site scripting attacks.
    (CVE-2012-2687)

  - An error exists related to 'mod_proxy_ajp' and     'mod_proxy_http' that can allow connections to remain     open. This condition can allow information disclosure     when combined with specially crafted requests.
    (CVE-2012-3502)

Note that Nessus did not actually test for these issues, but instead has relied on the version in the server's banner.

ID	Name	Product	Family	Severity
98901	Apache 2.4.x < 2.4.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
6550	Apache 2.4.1, 2.4.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
61644	Apache 2.4.x < 2.4.3 Multiple Vulnerabilities	Nessus	Web Servers	medium

Detections

Analytics

CVE-2012-3502

high

Tenable Plugins

high

medium

medium