VYPR
Unrated severityNVD Advisory· Published Apr 15, 2014· Updated May 6, 2026

CVE-2013-5704

CVE-2013-5704

Description

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

Affected products

71
  • Apache/Http Server34 versions
    cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*+ 33 more
    • cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.17:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.18:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.19:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.20:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.21:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.22:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.23:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.24:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.25:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.26:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.27:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.4.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.4.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.4.7:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:http_server:2.4.9:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:oracle:enterprise_manager_ops_center:*:*:*:*:*:*:*:*range: <12.1.4
    • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:http_server:10.1.3.5.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:oracle:http_server:10.1.3.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:http_server:11.1.1.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:http_server:12.1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:http_server:12.1.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
    Range: <10.10.4
  • cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:*
    Range: <5.0.3
  • cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*+ 3 more
    • cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
  • cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
  • cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

47

News mentions

0

No linked articles in our index yet.