Evil-DB LogoEvil-DB
← All CVEs

CVE-2004-0189

high · 7.5

The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.

7.5
CVSS
13.8%
EPSS (exploit prob.)
96th
EPSS percentile
2004-03-15
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

VendorProductAffected versions
squidsquid2.0_patch2
squidsquid2.1_patch2
squidsquid2.3_stable5
squidsquid2.4
squidsquid2.4_stable7
squidsquid2.5_stable3
squidsquid2.5_stable4

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2004-0189