Home

CVE-2019-12523

Description

An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesnt go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost.

Risk Information

Base Score
9.1
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score
Exploitation Probability
0.557

Associated Vulnerability

VulnerabilityOS Platform
Web proxy cache server (USN-4213-1) squid_4.4-1ubuntu2.3_i386.debLinux
Web proxy cache server (USN-4213-1) squid_4.4-1ubuntu2.3_amd64.debLinux
Web proxy cache server (USN-4213-1) squid_4.8-1ubuntu2.1_i386.debLinux
Web proxy cache server (USN-4213-1) squid_4.8-1ubuntu2.1_amd64.debLinux
Web proxy cache server (USN-4213-1) squid3_3.5.12-1ubuntu7.9_all.debLinux
Web proxy cache server (USN-4213-1) squid3_3.5.27-1ubuntu1.4_all.debLinux
squid security update(DSA-4682-1) squid_4.6-1+deb10u2_i386.debLinux
squid security update(DSA-4682-1) squid_4.6-1+deb10u2_amd64.debLinux
Web proxy cache server (USN-4446-1) squid_3.5.27-1ubuntu1.7_i386.debLinux
Web proxy cache server (USN-4446-1) squid_3.5.27-1ubuntu1.7_amd64.debLinux
Web proxy cache server (USN-4446-1) squid_3.5.12-1ubuntu7.12_i386.debLinux
Web proxy cache server (USN-4446-1) squid_3.5.12-1ubuntu7.12_amd64.debLinux
(RHSA-2020:4743) squid:4 security, bug fix, and enhancement update squid-4.11-3.module+el8.3.0+7851+7808b5f9.x86_64.rpmLinux
(RHSA-2020:4743) squid:4 security, bug fix, and enhancement update squid-debugsource-4.11-3.module+el8.3.0+7851+7808b5f9.x86_64.rpmLinux
Web proxy cache server (USN-4213-1) squid3_3.5.27-1ubuntu1.4_all.debLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234