CVE-2012-3502: Infoleak
The proxy functionality in (1) modproxyajp.c in the modproxyajp module and (2) modproxyhttp.c in the modproxyhttp module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3502?
CVE-2012-3502 has a medium severity rating with a CVSS score of 5.0.
How do I fix CVE-2012-3502?
To mitigate CVE-2012-3502, upgrade your Apache HTTP Server to version 2.4.3 or later.
What versions of Apache are affected by CVE-2012-3502?
CVE-2012-3502 affects Apache HTTP Server versions 2.4.0 to 2.4.2.
What type of attack does CVE-2012-3502 expose the server to?
CVE-2012-3502 allows remote attackers to obtain sensitive information through potentially open back-end connections.
What components are involved in CVE-2012-3502?
CVE-2012-3502 involves the mod_proxy_ajp and mod_proxy_http modules of Apache HTTP Server.