CVE-2010-2791 — Sensitive Information Exposure in Apache Http Server

CWE-200 — Sensitive Information Exposure8 documents8 sources
Severity
5.0MEDIUMNVD
EPSS
2.1%
top 16.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apache Http Server
Timeline
PublishedAug 5
Latest updateMay 13

Description

mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

🔴Vulnerability Details

3
GHSA
GHSA-2753-42q2-rqvx: mod_proxy in httpd in Apache HTTP Server 2↗2022-05-13
▶
CVEList
CVE-2010-2791: mod_proxy in httpd in Apache HTTP Server 2↗2010-08-05
▶
OSV
CVE-2010-2791: mod_proxy in httpd in Apache HTTP Server 2↗2010-08-05
▶

📋Vendor Advisories

3
Red Hat
httpd: Reverse proxy sends wrong responses after time-outs↗2010-07-23
▶
Debian
CVE-2010-2791: apache2 - mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not c...↗2010
▶
Apache
Apache httpd: CVE-2010-2791↗
▶

💬Community

1
Bugzilla
CVE-2010-2791 httpd: Reverse proxy sends wrong responses after time-outs↗2010-07-23
▶
CVE-2010-2791 — Sensitive Information Exposure | cvebase