1. Home
  2. CVE Database
  3. CVE-2018-11783
HIGH · 7.5

CVE-2018-11783

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in so...

Vulnerability Description

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
ApacheTraffic Server>= 6.0.0, <= 6.0.3

Related Weaknesses (CWE)

CWE-200

References

FAQ

What is CVE-2018-11783?

CVE-2018-11783 is a vulnerability with a CVSS score of 7.5 (HIGH). sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in so...

How severe is CVE-2018-11783?

CVE-2018-11783 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-11783?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Traffic Server.