CVE-2005-3751 HTTP request smuggling vulnerability in Pound before 1.9.4 allows remote attackers to poison web caches, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with co...
MediumCVSS 4.3
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
HTTP request smuggling vulnerability in Pound before 1.9.4 allows remote attackers to poison web caches, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with conflicting Content-length and Transfer-encoding headers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apsis pound | <= 1.9.3 | No fix listed |
| debian/pound(Debian:13) | < 1.9.4-1 | 1.9.4-1 |
| debian/pound(Debian:14) | < 1.9.4-1 | 1.9.4-1 |
References
- 18367 third-party-advisory vendor-advisory
- 18381 third-party-advisory vendor-advisory
- 20215 third-party-advisory vendor-advisory
- 20510 third-party-advisory vendor-advisory
- [pound-list] 20051020 ANNOUNCE: Pound - reverse proxy and load balancer - v1.9.4 mailing-list
- DSA-934 vendor-advisory
- GLSA-200606-05 vendor-advisory
- SUSE-SR:2006:011 vendor-advisory
- Debian Security Tracker CVE-2005-3751 vendor-advisory