CVE-2019-12524

Katalog CVE

CVSS 9.8 · Critical EPSS 3,9%

Kerentanan Missing Authentication for Critical Function pada squid-cache squid, debian linux +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource.

Rincian

Terbit di NVD

15 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

3,9% peluang dieksploitasi; lebih tinggi dari 89,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12524.txt advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210205-0006/ advisory pihak ketiga
• https://usn.ubuntu.com/4446-1/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4682 advisory pihak ketiga