Information disclosure in Apache Http Server

CVE-2001-1556

The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.

EPSS: 0.036 (88.1th percentile) — read the EPSS interpretation.

Affected products

Apache Http_server
N/a — versions n/a

Weakness classification (CWE)

CWE-532 — Insertion of Sensitive Information into Log File

References

cve@mitre.org (vdb-entry, Broken Link, x_refsource_XF)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, Broken Link)