UpHeron
All vulnerabilities

Servers and applications

CVE-2011-3368

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

Severity
Medium 5.0
Published
5 Oct 2011
Last changed
16 Jun 2026
Added to UpHeron
17 Oct 2026
Exploit chance
91% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Improper input validation (CWE-20)
Attack
Over the network · No login needed
Attacker can
Read some data
CVSS vector
AV:N/AC:L/Au:N/C:P/I:N/A:N
Sources
NVD

Affected software

SoftwareAffected versions
Apache HTTP ServerServers and applications · cpe:a:apache:http_server
  • Version 2.2.21
  • Version 2.2.20
  • Version 2.2.19
  • Version 2.2.18
All 99 release lines
  • Version 1.3
  • Version 1.3.1
  • Version 1.3.1.1
  • Version 1.3.2
  • Version 1.3.3
  • Version 1.3.4
  • Version 1.3.5
  • Version 1.3.6
  • Version 1.3.7
  • Version 1.3.8
  • Version 1.3.9
  • Version 1.3.10
  • Version 1.3.11
  • Version 1.3.12
  • Version 1.3.13
  • Version 1.3.14
  • Version 1.3.15
  • Version 1.3.16
  • Version 1.3.17
  • Version 1.3.18
  • Version 1.3.19
  • Version 1.3.20
  • Version 1.3.22
  • Version 1.3.23
  • Version 1.3.24
  • Version 1.3.25
  • Version 1.3.26
  • Version 1.3.27
  • Version 1.3.28
  • Version 1.3.29
  • Version 1.3.30
  • Version 1.3.31
  • Version 1.3.32
  • Version 1.3.33
  • Version 1.3.34
  • Version 1.3.35
  • Version 1.3.36
  • Version 1.3.37
  • Version 1.3.38
  • Version 1.3.39
  • Version 1.3.41
  • Version 1.3.42
  • Version 1.3.65
  • Version 1.3.68
  • Version 2.0
  • Version 2.0.9
  • Version 2.0.28-beta
  • Version 2.0.28
  • Version 2.0.32-beta
  • Version 2.0.32
  • Version 2.0.34-beta
  • Version 2.0.35
  • Version 2.0.36
  • Version 2.0.37
  • Version 2.0.38
  • Version 2.0.39
  • Version 2.0.40
  • Version 2.0.41
  • Version 2.0.42
  • Version 2.0.43
  • Version 2.0.44
  • Version 2.0.45
  • Version 2.0.46
  • Version 2.0.47
  • Version 2.0.48
  • Version 2.0.49
  • Version 2.0.50
  • Version 2.0.51
  • Version 2.0.52
  • Version 2.0.53
  • Version 2.0.54
  • Version 2.0.55
  • Version 2.0.56
  • Version 2.0.57
  • Version 2.0.58
  • Version 2.0.59
  • Version 2.0.60
  • Version 2.0.61
  • Version 2.0.63
  • Version 2.0.64
  • Version 2.2.0
  • Version 2.2.1
  • Version 2.2.2
  • Version 2.2.3
  • Version 2.2.4
  • Version 2.2.6
  • Version 2.2.8
  • Version 2.2.9
  • Version 2.2.10
  • Version 2.2.11
  • Version 2.2.12
  • Version 2.2.13
  • Version 2.2.14
  • Version 2.2.15
  • Version 2.2.16
  • Version 2.2.18
  • Version 2.2.19
  • Version 2.2.20
  • Version 2.2.21

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2011-3368
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2011-3368