CVE-2005-2088

MEDIUM Year: 2005
CVSS v2 Score
4.3
Medium
Weakness Type
CWE-444
View all →

Vulnerability Description

The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

Related Vulnerabilities

CVE-2023-41265

CRITICAL
CVSS:9.9(Critical)

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and...

CWE-4442023

CVE-2023-48365

CRITICAL
CVSS:9.9(Critical)

Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevat...

CWE-4442023

CVE-2015-5739

CRITICAL
CVSS:9.8(Critical)

The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead...

CWE-4442015

CVE-2015-5740

CRITICAL
CVSS:9.8(Critical)

The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Con...

CWE-4442015

CVE-2015-5741

CRITICAL
CVSS:9.8(Critical)

The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contain...

CWE-4442015

CVE-2016-10711

CRITICAL
CVSS:9.8(Critical)

Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751.

CWE-4442016