CVE-2013-1862
mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
- EPSS
- 25% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:http_server
- canonical:ubuntu_linux
- opensuse:opensuse
- oracle:http_server
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_workstation
- redhat:jboss_enterprise_application_platform
References
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html
- http://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patch
- http://rhn.redhat.com/errata/RHSA-2013-0815.html