An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost.
https://bugzilla.suse.com/show_bug.cgi?id=1156329
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html
http://www.squid-cache.org/Advisories/SQUID-2019_8.txt
https://usn.ubuntu.com/4213-1/
https://www.debian.org/security/2020/dsa-4682
https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
Source: MITRE
Published: 2019-11-26
Updated: 2023-02-28
Type: NVD-CWE-noinfo
Base Score: 6.4
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Impact Score: 4.9
Exploitability Score: 10
Severity: MEDIUM
Base Score: 9.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Impact Score: 5.2
Exploitability Score: 3.9
Severity: CRITICAL