CVE-2003-1286 HTTP Proxy in Sambar Server before 6.0 beta 6, when security.ini lacks a 127.0.0.1 proxydeny entry, allows remote attackers to send proxy HTTP requests to the Sambar Server's administrative interface....
HighCVSS 7.5
EPSS 3.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
HTTP Proxy in Sambar Server before 6.0 beta 6, when security.ini lacks a 127.0.0.1 proxydeny entry, allows remote attackers to send proxy HTTP requests to the Sambar Server's administrative interface and external web servers, by making a "Connection: keep-alive" request before the proxy requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sambar server | = 5.0 | No fix listed |
| sambar server | = 5.0-beta1 | No fix listed |
| sambar server | = 5.0-beta2 | No fix listed |
| sambar server | = 5.0-beta3 | No fix listed |
| sambar server | = 5.0-beta4 | No fix listed |
| sambar server | = 5.0-beta5 | No fix listed |
| sambar server | = 5.0-beta6 | No fix listed |
| sambar server | = 5.1 | No fix listed |
| sambar server | = 5.1-beta1 | No fix listed |
| sambar server | = 5.1-beta2 | No fix listed |
| sambar server | = 5.1-beta3 | No fix listed |
| sambar server | = 5.1-beta4 | No fix listed |
| sambar server | = 5.1-beta5 | No fix listed |
| sambar server | = 5.2 | No fix listed |
| sambar server | = 5.3 | No fix listed |
| sambar server | = 6.0-beta1 | No fix listed |
| sambar server | = 6.0-beta2 | No fix listed |
| sambar server | = 6.0-beta3 | No fix listed |
| sambar server | = 6.0-beta4 | No fix listed |
| sambar server | = 6.0-beta5 | No fix listed |
References
- 20040430 SECURITY.NNOV: Sambar security quest mailing-list vendor-advisory
- 9578 third-party-advisory vendor-advisory
- 1007819 patch vdb-entry
- 20030925 Sambar Server Multiple Vulnerabilities third-party-advisory vendor-advisory
- www.sambar.com vendor-advisory
- 10256 exploit patch vdb-entry
- sambar-http-gain-access(16054) vdb-entry