CVE-2001-1556
published 2001-12-31CVE-2001-1556: The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote…
PriorityP417medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
3.56%
88.1th percentile
The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 1.3.0 < 1.3.31 | 1.3.31 |
| apache | http_server | >= 2.0.0 < 2.0.49 | 2.0.49 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
httpd: log files contain information directly supplied by clients and does not filter or quote control characters
vendor_redhat·2001-12-31·CVSS 5.0
CVE-2001-1556 [MEDIUM] CWE-532 httpd: log files contain information directly supplied by clients and does not filter or quote control characters
httpd: log files contain information directly supplied by clients and does not filter or quote control characters
The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.
Statement: This is a duplicate CVE name and is a combination of CVE-2003-0020 and CVE-2003-0083.
Package: httpd (Red Hat Enterprise Linux 5) - Not affected
Package: httpd (Red Hat Enterprise Linux 6) - Not affected
Package: httpd (Red Hat Enterprise Linux 7) - Not affected
Package: httpd:2.4/httpd (Red Hat Enterprise Linux 8) - Not affected
Package: httpd (Red Hat JBoss Core Services) -
GHSA
GHSA-9f54-6r7j-3hph: The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow
ghsa_unreviewed·2022-04-30
CVE-2001-1556 [MEDIUM] CWE-532 GHSA-9f54-6r7j-3hph: The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow
The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.
No detection rules found.
No public exploits indexed.
http://archives.neohapsis.com/archives/bugtraq/2001-10/0231.htmlhttp://httpd.apache.org/docs/logs.htmlhttp://www.iss.net/security_center/static/7363.phphttp://archives.neohapsis.com/archives/bugtraq/2001-10/0231.htmlhttp://httpd.apache.org/docs/logs.htmlhttp://www.iss.net/security_center/static/7363.php
2001-12-31
Published