CVE-2001-1556
CVSS V2 Medium 5
CVSS V3 None
Description
The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.
Overview
- CVE ID
- CVE-2001-1556
- Assigner
- cve@mitre.org
- Vulnerability Status
- Analyzed
- Published Version
- 2001-12-31T05:00:00
- Last Modified Date
- 2020-10-14T16:51:00
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 1 | OR | 1.3.0 | 1.3.31 |
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 1 | OR | 2.0.0 | 2.0.49 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:N/C:N/I:P/A:N
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- NONE
- Integrity Impact
- PARTIAL
- Availability Impact
- NONE
- Base Score
- 5
- Severity
- MEDIUM
- Exploitability Score
- 10
- Impact Score
- 2.9
References
| Reference URL | Reference Tags |
|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2001-10/0231.html | Broken Link |
| http://httpd.apache.org/docs/logs.html | Vendor Advisory |
| http://www.iss.net/security_center/static/7363.php | Broken Link |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2001-1556 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1556 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 17:08:51 | Added to TrackCVE |