Read the docs
TI-2011-02978 Aliases CVE-2011-3368GHSA-j85c-9w9v-p2p3

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through…

Priority HIGH 66CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
Partial Red Hat: 11 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

Why it matters now

EPSS 0.90734 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD and the CNA
Fix Partial Red Hat: 4 advisoriesRed Hat: 11 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 100

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:*1.3VulnerableApache
cpe:2.3:a:apache:http_server:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableApache
cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableApache
cpe:2.3:a:apache:http_server:1.3.1.1:*:*:*:*:*:*:*1.3.1.1VulnerableApache
cpe:2.3:a:apache:http_server:1.3.2:*:*:*:*:*:*:*1.3.2VulnerableApache
cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:*1.3.3VulnerableApache
cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:*1.3.4VulnerableApache
cpe:2.3:a:apache:http_server:1.3.5:*:*:*:*:*:*:*1.3.5VulnerableApache
cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:*1.3.6VulnerableApache
cpe:2.3:a:apache:http_server:1.3.7:*:*:*:*:*:*:*1.3.7VulnerableApache
  • cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.1.1:*:*:*:*:*:*:* Versions 1.3.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.5:*:*:*:*:*:*:* Versions 1.3.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:* Versions 1.3.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.7:*:*:*:*:*:*:* Versions 1.3.7 Vulnerable ·Apache
Show 90 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:1.3.8:*:*:*:*:*:*:*1.3.8VulnerableApache
cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*1.3.9VulnerableApache
cpe:2.3:a:apache:http_server:1.3.10:*:*:*:*:*:*:*1.3.10VulnerableApache
cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:*1.3.11VulnerableApache
cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:*1.3.12VulnerableApache
cpe:2.3:a:apache:http_server:1.3.13:*:*:*:*:*:*:*1.3.13VulnerableApache
cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:*1.3.14VulnerableApache
cpe:2.3:a:apache:http_server:1.3.15:*:*:*:*:*:*:*1.3.15VulnerableApache
cpe:2.3:a:apache:http_server:1.3.16:*:*:*:*:*:*:*1.3.16VulnerableApache
cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:*1.3.17VulnerableApache
cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:*1.3.18VulnerableApache
cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:*1.3.19VulnerableApache
cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:*1.3.20VulnerableApache
cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:*1.3.22VulnerableApache
cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:*1.3.23VulnerableApache
cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:*1.3.24VulnerableApache
cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:*1.3.25VulnerableApache
cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:*1.3.26VulnerableApache
cpe:2.3:a:apache:http_server:1.3.27:*:*:*:*:*:*:*1.3.27VulnerableApache
cpe:2.3:a:apache:http_server:1.3.28:*:*:*:*:*:*:*1.3.28VulnerableApache
cpe:2.3:a:apache:http_server:1.3.29:*:*:*:*:*:*:*1.3.29VulnerableApache
cpe:2.3:a:apache:http_server:1.3.30:*:*:*:*:*:*:*1.3.30VulnerableApache
cpe:2.3:a:apache:http_server:1.3.31:*:*:*:*:*:*:*1.3.31VulnerableApache
cpe:2.3:a:apache:http_server:1.3.32:*:*:*:*:*:*:*1.3.32VulnerableApache
cpe:2.3:a:apache:http_server:1.3.33:*:*:*:*:*:*:*1.3.33VulnerableApache
cpe:2.3:a:apache:http_server:1.3.34:*:*:*:*:*:*:*1.3.34VulnerableApache
cpe:2.3:a:apache:http_server:1.3.35:*:*:*:*:*:*:*1.3.35VulnerableApache
cpe:2.3:a:apache:http_server:1.3.36:*:*:*:*:*:*:*1.3.36VulnerableApache
cpe:2.3:a:apache:http_server:1.3.37:*:*:*:*:*:*:*1.3.37VulnerableApache
cpe:2.3:a:apache:http_server:1.3.38:*:*:*:*:*:*:*1.3.38VulnerableApache
cpe:2.3:a:apache:http_server:1.3.39:*:*:*:*:*:*:*1.3.39VulnerableApache
cpe:2.3:a:apache:http_server:1.3.41:*:*:*:*:*:*:*1.3.41VulnerableApache
cpe:2.3:a:apache:http_server:1.3.42:*:*:*:*:*:*:*1.3.42VulnerableApache
cpe:2.3:a:apache:http_server:1.3.65:*:*:*:*:*:*:*1.3.65VulnerableApache
cpe:2.3:a:apache:http_server:1.3.68:*:*:*:*:*:*:*1.3.68VulnerableApache
cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*2.0VulnerableApache
cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*2.0.9VulnerableApache
cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*2.0.28VulnerableApache
cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*2.0.28 betaVulnerableApache
cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*2.0.32VulnerableApache
cpe:2.3:a:apache:http_server:2.0.32:beta:*:*:*:*:*:*2.0.32 betaVulnerableApache
cpe:2.3:a:apache:http_server:2.0.34:beta:*:*:*:*:*:*2.0.34 betaVulnerableApache
cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*2.0.35VulnerableApache
cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*2.0.36VulnerableApache
cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*2.0.37VulnerableApache
cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*2.0.38VulnerableApache
cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*2.0.39VulnerableApache
cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*2.0.40VulnerableApache
cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*2.0.41VulnerableApache
cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*2.0.42VulnerableApache
cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*2.0.43VulnerableApache
cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*2.0.44VulnerableApache
cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*2.0.45VulnerableApache
cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*2.0.46VulnerableApache
cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*2.0.47VulnerableApache
cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*2.0.48VulnerableApache
cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:*2.0.49VulnerableApache
cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:*2.0.50VulnerableApache
cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:*2.0.51VulnerableApache
cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:*2.0.52VulnerableApache
cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:*2.0.53VulnerableApache
cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:*2.0.54VulnerableApache
cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:*2.0.55VulnerableApache
cpe:2.3:a:apache:http_server:2.0.56:*:*:*:*:*:*:*2.0.56VulnerableApache
cpe:2.3:a:apache:http_server:2.0.57:*:*:*:*:*:*:*2.0.57VulnerableApache
cpe:2.3:a:apache:http_server:2.0.58:*:*:*:*:*:*:*2.0.58VulnerableApache
cpe:2.3:a:apache:http_server:2.0.59:*:*:*:*:*:*:*2.0.59VulnerableApache
cpe:2.3:a:apache:http_server:2.0.60:*:*:*:*:*:*:*2.0.60VulnerableApache
cpe:2.3:a:apache:http_server:2.0.61:*:*:*:*:*:*:*2.0.61VulnerableApache
cpe:2.3:a:apache:http_server:2.0.63:*:*:*:*:*:*:*2.0.63VulnerableApache
cpe:2.3:a:apache:http_server:2.0.64:*:*:*:*:*:*:*2.0.64VulnerableApache
cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableApache
cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableApache
cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableApache
cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableApache
cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*2.2.4VulnerableApache
cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:*2.2.6VulnerableApache
cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:*2.2.8VulnerableApache
cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:*2.2.9VulnerableApache
cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:*2.2.10VulnerableApache
cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:*2.2.11VulnerableApache
cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:*2.2.12VulnerableApache
cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:*2.2.13VulnerableApache
cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:*2.2.14VulnerableApache
cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*2.2.15VulnerableApache
cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:*2.2.16VulnerableApache
cpe:2.3:a:apache:http_server:2.2.18:*:*:*:*:*:*:*2.2.18VulnerableApache
cpe:2.3:a:apache:http_server:2.2.19:*:*:*:*:*:*:*2.2.19VulnerableApache
cpe:2.3:a:apache:http_server:2.2.20:*:*:*:*:*:*:*2.2.20VulnerableApache
cpe:2.3:a:apache:http_server:2.2.21:*:*:*:*:*:*:*2.2.21VulnerableApache
  • cpe:2.3:a:apache:http_server:1.3.8:*:*:*:*:*:*:* Versions 1.3.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:* Versions 1.3.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.10:*:*:*:*:*:*:* Versions 1.3.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:* Versions 1.3.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:* Versions 1.3.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.13:*:*:*:*:*:*:* Versions 1.3.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:* Versions 1.3.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.15:*:*:*:*:*:*:* Versions 1.3.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.16:*:*:*:*:*:*:* Versions 1.3.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:* Versions 1.3.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:* Versions 1.3.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:* Versions 1.3.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:* Versions 1.3.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:* Versions 1.3.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:* Versions 1.3.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:* Versions 1.3.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:* Versions 1.3.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:* Versions 1.3.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.27:*:*:*:*:*:*:* Versions 1.3.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.28:*:*:*:*:*:*:* Versions 1.3.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.29:*:*:*:*:*:*:* Versions 1.3.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.30:*:*:*:*:*:*:* Versions 1.3.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.31:*:*:*:*:*:*:* Versions 1.3.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.32:*:*:*:*:*:*:* Versions 1.3.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.33:*:*:*:*:*:*:* Versions 1.3.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.34:*:*:*:*:*:*:* Versions 1.3.34 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.35:*:*:*:*:*:*:* Versions 1.3.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.36:*:*:*:*:*:*:* Versions 1.3.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.37:*:*:*:*:*:*:* Versions 1.3.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.38:*:*:*:*:*:*:* Versions 1.3.38 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.39:*:*:*:*:*:*:* Versions 1.3.39 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.41:*:*:*:*:*:*:* Versions 1.3.41 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.42:*:*:*:*:*:*:* Versions 1.3.42 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.65:*:*:*:*:*:*:* Versions 1.3.65 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.68:*:*:*:*:*:*:* Versions 1.3.68 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:* Versions 2.0.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:* Versions 2.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:* Versions 2.0.28 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:* Versions 2.0.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.32:beta:*:*:*:*:*:* Versions 2.0.32 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.34:beta:*:*:*:*:*:* Versions 2.0.34 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:* Versions 2.0.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:* Versions 2.0.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:* Versions 2.0.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:* Versions 2.0.38 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:* Versions 2.0.39 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:* Versions 2.0.40 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:* Versions 2.0.41 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:* Versions 2.0.42 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:* Versions 2.0.43 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:* Versions 2.0.44 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:* Versions 2.0.45 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:* Versions 2.0.46 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:* Versions 2.0.47 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:* Versions 2.0.48 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:* Versions 2.0.49 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:* Versions 2.0.50 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:* Versions 2.0.51 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:* Versions 2.0.52 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:* Versions 2.0.53 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:* Versions 2.0.54 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:* Versions 2.0.55 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.56:*:*:*:*:*:*:* Versions 2.0.56 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.57:*:*:*:*:*:*:* Versions 2.0.57 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.58:*:*:*:*:*:*:* Versions 2.0.58 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.59:*:*:*:*:*:*:* Versions 2.0.59 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.60:*:*:*:*:*:*:* Versions 2.0.60 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.61:*:*:*:*:*:*:* Versions 2.0.61 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.63:*:*:*:*:*:*:* Versions 2.0.63 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.64:*:*:*:*:*:*:* Versions 2.0.64 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:* Versions 2.2.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:* Versions 2.2.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:* Versions 2.2.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:* Versions 2.2.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:* Versions 2.2.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:* Versions 2.2.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:* Versions 2.2.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:* Versions 2.2.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:* Versions 2.2.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.18:*:*:*:*:*:*:* Versions 2.2.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.19:*:*:*:*:*:*:* Versions 2.2.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.20:*:*:*:*:*:*:* Versions 2.2.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.21:*:*:*:*:*:*:* Versions 2.2.21 Vulnerable ·Apache

Remediation

Red Hat 4 advisories

  • RHSA-2012:0543 Released 2012-05-07 · Red Hat rating Moderate
    httpd security and bug fix update
    • Red Hat JBoss Web Server 1.0
  • RHSA-2012:0542 Released 2012-05-07 · Red Hat rating Moderate
    httpd security and bug fix update
    • Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server httpd-2.2.17-15.4.ep5.el5, httpd-2.2.17-15.4.ep5.el5.i386, httpd-devel-2.2.17-15.4.ep5.el5 +5
    • Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server httpd-2.2.17-15.4.ep5.el6, httpd-2.2.17-15.4.ep5.el6.i386, httpd-devel-2.2.17-15.4.ep5.el6 +7
  • RHSA-2011:1392 Released 2011-10-20 · Red Hat rating Moderate
    httpd security and bug fix update
    • RHEL Desktop Workstation (v. 5 client) httpd-2.2.3-53.el5_7.3, httpd-devel-2.2.3-53.el5_7.3, httpd-devel-2.2.3-53.el5_7.3.i386 +2
    • Red Hat Enterprise Linux (v. 5 server) httpd-2.2.3-53.el5_7.3, httpd-2.2.3-53.el5_7.3.i386, httpd-2.2.3-53.el5_7.3.ia64 +13
    • Red Hat Enterprise Linux AS version 4 httpd-2.0.52-49.ent, httpd-2.0.52-49.ent.i386, httpd-2.0.52-49.ent.ia64 +17
    • Red Hat Enterprise Linux Desktop (v. 5 client) httpd-2.2.3-53.el5_7.3, httpd-2.2.3-53.el5_7.3.i386, mod_ssl-1:2.2.3-53.el5_7.3 +1
    • Red Hat Enterprise Linux Desktop version 4 httpd-2.0.52-49.ent, httpd-2.0.52-49.ent.i386, httpd-devel-2.0.52-49.ent +7
    • Red Hat Enterprise Linux ES version 4 httpd-2.0.52-49.ent, httpd-2.0.52-49.ent.i386, httpd-2.0.52-49.ent.ia64 +12
    • Red Hat Enterprise Linux WS version 4 httpd-2.0.52-49.ent, httpd-2.0.52-49.ent.i386, httpd-2.0.52-49.ent.ia64 +12
Show 1 more Red Hat advisories
  • RHSA-2011:1391 Released 2011-10-20 · Red Hat rating Moderate
    httpd security and bug fix update
    • Red Hat Enterprise Linux Server (v. 6) httpd-2.2.15-9.el6_1.3, httpd-devel-2.2.15-9.el6_1.3, httpd-devel-2.2.15-9.el6_1.3.ppc +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Directory Server 8AffectedNo fix planned: Will not fix
RHEL Desktop Workstation (v. 5 client)Fixed RHSA-2011:1392
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2011:1392
Red Hat Enterprise Linux AS version 4Fixed RHSA-2011:1392
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2011:1392
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2011:1392
Red Hat Enterprise Linux ES version 4Fixed RHSA-2011:1392
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:1391
Red Hat Enterprise Linux WS version 4Fixed RHSA-2011:1392
Red Hat JBoss Enterprise Web Server 1 for RHEL 5 ServerFixed RHSA-2012:0542
Red Hat JBoss Enterprise Web Server 1 for RHEL 6 ServerFixed RHSA-2012:0542
Red Hat JBoss Web Server 1.0Fixed RHSA-2012:0543

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-3368
  2. 2026-10-03 Alias added: GHSA-j85c-9w9v-p2p3

References

Exploit 3

Patch 1

Advisory 15

Other 30

  • TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-25716 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
  • TI-2019-00184 Use after free in Apache HTTP Server KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 349 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences