CVE-2011-1498

Published: Jul 7, 2011Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.

Affected (12)

Products: Apache: Httpclient

1 product

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Apache Httpclient	Version 4.0.1
Apache Httpclient	Version 4.0
Apache Httpclient	Version 4.0 alpha1
Apache Httpclient	Version 4.0 alpha2
Apache Httpclient	Version 4.0 alpha3
Apache Httpclient	Version 4.0 alpha4
Apache Httpclient	Version 4.0 beta1
Apache Httpclient	Version 4.0 beta2
Apache Httpclient	Version 4.1
Apache Httpclient	Version 4.1 alpha1
Apache Httpclient	Version 4.1 alpha2
Apache Httpclient	Version 4.1 beta1

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (28)

http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061440.html

Source: secalert@redhat.com

http://marc.info/?l=httpclient-users&m=129853896315461&w=2

Source: secalert@redhat.com

http://marc.info/?l=httpclient-users&m=129856318011586&w=2

Source: secalert@redhat.com

http://marc.info/?l=httpclient-users&m=129857589129183&w=2

Source: secalert@redhat.com

http://marc.info/?l=httpclient-users&m=129858274406594&w=2

Source: secalert@redhat.com

http://marc.info/?l=httpclient-users&m=129858299106950&w=2

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/04/07/7

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/04/08/1

Source: secalert@redhat.com

http://securityreason.com/securityalert/8298

Source: secalert@redhat.com

http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.1.x.txt

Source: secalert@redhat.com

http://www.kb.cert.org/vuls/id/153049

Source: secalert@redhat.com

US Government Resource

http://www.securityfocus.com/bid/46974

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=709531

Source: secalert@redhat.com

https://issues.apache.org/jira/browse/HTTPCLIENT-1061

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061440.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=httpclient-users&m=129853896315461&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=httpclient-users&m=129856318011586&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=httpclient-users&m=129857589129183&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=httpclient-users&m=129858274406594&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=httpclient-users&m=129858299106950&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2011/04/07/7

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2011/04/08/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/8298

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.1.x.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.kb.cert.org/vuls/id/153049

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.securityfocus.com/bid/46974

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=709531

Source: af854a3a-2127-422b-91ae-364da2661108

https://issues.apache.org/jira/browse/HTTPCLIENT-1061

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.