CVE-2012-0053
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header...
4.3 MediumPublic exploitFix available
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
Exploit likelihood
82.2%Up 8.1 points since Feb 4, 2022
What each source reports
NVD Score used
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
- Record
CVE-2012-0053- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
- Record
CVE-2012-0053- Updated
- 2026-11-02
EUVDEUVD-2012-0092 No score
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
- Record
EUVD-2012-0092- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x2wg-fp56-xx79 No score
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header...
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
- Record
GHSA-x2wg-fp56-xx79- Updated
- 2026-11-02
OSVBELL-CVE-2012-0053
CVE-2012-0053 does not affect BellSoft software
- Record
BELL-CVE-2012-0053- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
OSV No score
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
- Record
CVE-2012-0053- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-0053 No score
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
- Record
DEBIAN-CVE-2012-0053- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10268-1 No score
apache2-2.4.23-4.1 on GA media
These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10268-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 |
before 2.2.22-1 | 2.2.22-1 |
apache2Debian:13 |
before 2.2.22-1 | 2.2.22-1 |
apache2Debian:14 |
before 2.2.22-1 | 2.2.22-1 |
apache2Debian:6.0 From an advisory covering 6 CVEs |
before 2.2.16-6+squeeze6, plus listed versions 2.2.16-62.2.16-6+squeeze12.2.16-6+squeeze1~bpo50+12.2.16-6+squeeze22.2.16-6+squeeze2~bpo50+12.2.16-6+squeeze32.2.16-6+squeeze42.2.16-6+squeeze4~bpo50+1 |
2.2.16-6+squeeze6 |
apache2Debian:5.0 From an advisory covering 6 CVEs |
before 2.2.9-10+lenny12, plus listed versions 2.2.9-10+lenny102.2.9-10+lenny112.2.9-10+lenny22.2.9-10+lenny32.2.9-10+lenny4 Show 5 moreShow less2.2.9-10+lenny52.2.9-10+lenny62.2.9-10+lenny72.2.9-10+lenny82.2.9-10+lenny9 |
2.2.9-10+lenny12 |
httpdRed Hat:enterprise_linux:6::client From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-toolsRed Hat:enterprise_linux:6::client From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-develRed Hat:enterprise_linux:6::client From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-manualRed Hat:enterprise_linux:6::client From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
Show 41 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mod_sslRed Hat:enterprise_linux:6::client From an advisory covering 5 CVEs |
before 1:2.2.15-15.el6_2.1 | 1:2.2.15-15.el6_2.1 |
httpdRed Hat:enterprise_linux:6::computenode From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-toolsRed Hat:enterprise_linux:6::computenode From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-develRed Hat:enterprise_linux:6::computenode From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-manualRed Hat:enterprise_linux:6::computenode From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
mod_sslRed Hat:enterprise_linux:6::computenode From an advisory covering 5 CVEs |
before 1:2.2.15-15.el6_2.1 | 1:2.2.15-15.el6_2.1 |
httpdRed Hat:enterprise_linux:6::server From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-develRed Hat:enterprise_linux:6::server From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-manualRed Hat:enterprise_linux:6::server From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-toolsRed Hat:enterprise_linux:6::server From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
mod_sslRed Hat:enterprise_linux:6::server From an advisory covering 5 CVEs |
before 1:2.2.15-15.el6_2.1 | 1:2.2.15-15.el6_2.1 |
httpdRed Hat:enterprise_linux:6::workstation From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-develRed Hat:enterprise_linux:6::workstation From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-manualRed Hat:enterprise_linux:6::workstation From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
httpd-toolsRed Hat:enterprise_linux:6::workstation From an advisory covering 5 CVEs |
before 0:2.2.15-15.el6_2.1 | 0:2.2.15-15.el6_2.1 |
mod_sslRed Hat:enterprise_linux:6::workstation From an advisory covering 5 CVEs |
before 1:2.2.15-15.el6_2.1 | 1:2.2.15-15.el6_2.1 |
httpdRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:2.2.3-63.el5_8.1 | 0:2.2.3-63.el5_8.1 |
httpd-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:2.2.3-63.el5_8.1 | 0:2.2.3-63.el5_8.1 |
mod_sslRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 1:2.2.3-63.el5_8.1 | 1:2.2.3-63.el5_8.1 |
httpdRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:2.2.3-63.el5_8.1 | 0:2.2.3-63.el5_8.1 |
httpd-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:2.2.3-63.el5_8.1 | 0:2.2.3-63.el5_8.1 |
httpd-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:2.2.3-63.el5_8.1 | 0:2.2.3-63.el5_8.1 |
httpd-manualRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:2.2.3-63.el5_8.1 | 0:2.2.3-63.el5_8.1 |
httpdRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:2.2.3-63.el5_8.1 | 0:2.2.3-63.el5_8.1 |
httpd-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:2.2.3-63.el5_8.1 | 0:2.2.3-63.el5_8.1 |
httpd-develRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:2.2.3-63.el5_8.1 | 0:2.2.3-63.el5_8.1 |
httpd-manualRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:2.2.3-63.el5_8.1 | 0:2.2.3-63.el5_8.1 |
mod_sslRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 1:2.2.3-63.el5_8.1 | 1:2.2.3-63.el5_8.1 |
httpdRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 6 CVEs |
before 0:2.2.17-15.4.ep5.el5 | 0:2.2.17-15.4.ep5.el5 |
httpd-develRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 6 CVEs |
before 0:2.2.17-15.4.ep5.el5 | 0:2.2.17-15.4.ep5.el5 |
httpd-manualRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 6 CVEs |
before 0:2.2.17-15.4.ep5.el5 | 0:2.2.17-15.4.ep5.el5 |
mod_sslRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 6 CVEs |
before 1:2.2.17-15.4.ep5.el5 | 1:2.2.17-15.4.ep5.el5 |
httpdRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 6 CVEs |
before 0:2.2.17-15.4.ep5.el6 | 0:2.2.17-15.4.ep5.el6 |
httpd-develRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 6 CVEs |
before 0:2.2.17-15.4.ep5.el6 | 0:2.2.17-15.4.ep5.el6 |
httpd-manualRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 6 CVEs |
before 0:2.2.17-15.4.ep5.el6 | 0:2.2.17-15.4.ep5.el6 |
httpd-toolsRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 6 CVEs |
before 0:2.2.17-15.4.ep5.el6 | 0:2.2.17-15.4.ep5.el6 |
mod_sslRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 6 CVEs |
before 1:2.2.17-15.4.ep5.el6 | 1:2.2.17-15.4.ep5.el6 |
apache2openSUSE:Tumbleweed From an advisory covering 48 CVEs |
before 2.4.23-4.1 | 2.4.23-4.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache - httpOnly Cookie Disclosure | 2012-01-31 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-0053 is a medium vulnerability (CVSS 4.3) in Apache Http Server, published January 28, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 82.2%, the 99th percentile. Fixed in apache2 2.2.22-1.
References
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
mandriva.com/security/advisories?name=MDVSA-2012:012
securityfocus.com/bid/51706
marc.info?l=bugtraq&m=136441204617335&w=2
rhn.redhat.com/errata/RHSA-2012-0543.html
Show 156 moreShow less
oracle.com/technetwork/topics/security/cpujan2015-1972971.html
httpd.apache.org/security/vulnerabilities_22.html
lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
support.apple.com/kb/HT5501
bugzilla.redhat.com/show_bug.cgi?id=785069
lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html
secunia.com/advisories/48551
svn.apache.org/viewvc?view=revision&revision=1235454
debian.org/security/2012/dsa-2405
kb.juniper.net/JSA10585
lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2012-0053
github.com/advisories/GHSA-x2wg-fp56-xx79
docs.bell-sw.com/security/cves/CVE-2012-0053
security-tracker.debian.org/tracker/CVE-2012-0053
access.redhat.com/errata/RHSA-2012:0128
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0128.json
cve.org/CVERecord?id=CVE-2011-3607
community.qualys.com/blogs/securitylabs/2011/11/23/apache-reverse-proxy-bypass-issue
contextis.com/research/blog/reverseproxybypass
suse.com/security/cve/CVE-2009-0023