CVE-2013-1862

medium · 5.1

mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.

5.1

CVSS

24.9%

EPSS (exploit prob.)

98th

EPSS percentile

2013-06-10

Published

AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected products

Vendor	Product	Affected versions
apache	http_server	>= 2.0.0, < 2.0.65
apache	http_server	>= 2.2.0, < 2.2.25
redhat	jboss_enterprise_application_platform	6.0.0
redhat	jboss_enterprise_application_platform	6.4.0
redhat	enterprise_linux	5.0
redhat	enterprise_linux	6.0
oracle	http_server	10.1.3.5.0
oracle	http_server	11.1.1.7.0
oracle	http_server	12.1.2.0
oracle	http_server	12.1.3.0
redhat	enterprise_linux_desktop	5.0
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_eus	5.9
redhat	enterprise_linux_eus	6.4
redhat	enterprise_linux_server	5.0
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_server_aus	5.9
redhat	enterprise_linux_server_aus	6.4
redhat	enterprise_linux_workstation	5.0
redhat	enterprise_linux_workstation	6.0
canonical	ubuntu_linux	10.04
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	12.10
canonical	ubuntu_linux	13.04
opensuse	opensuse	11.4
opensuse	opensuse	12.2
opensuse	opensuse	12.3

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-1862