Description (CNA)
WebWasher Classic 2.2.1 and 3.3, when running in server mode, does not properly drop CONNECT requests to the localhost from external systems, which could allow remote attackers to bypass intended access restrictions.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- http://secunia.com/advisories/14058
- http://www.securityfocus.com/bid/12394
- http://marc.info/?l=bugtraq&m=110693045507245&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19144
- http://www.oliverkarow.de/research/WebWasherCONNECT.txt
- http://securitytracker.com/id?1013036
ADP enrichment
No English description supplied.