CVE Vulnerabilities

CVE-2001-1556

Insertion of Sensitive Information into Log File

Published: Dec 31, 2001 | Modified: Apr 03, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
3.3 LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ubuntu

The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.

Weakness

The product writes sensitive information to a log file.

Affected Software

Name Vendor Start Version End Version
Http_server Apache 1.3.0 (including) 1.3.31 (excluding)
Http_server Apache 2.0.0 (including) 2.0.49 (excluding)

Potential Mitigations

References