CVE-2013-2503
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers...
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.
Exploit likelihood
What each source reports
NVD Score used
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.
- Record
CVE-2013-2503- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.
- Record
CVE-2013-2503- Updated
- 2026-11-02
EUVDEUVD-2013-2449 No score
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.
- Record
EUVD-2013-2449- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xwv2-6j43-gjcx No score
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers...
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.
- Record
GHSA-xwv2-6j43-gjcx- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.
- Record
CVE-2013-2503- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2503 No score
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.
- Record
DEBIAN-CVE-2013-2503- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-2503 No score
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.
- Record
UBUNTU-CVE-2013-2503- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Privoxy Proxy - Authentication Information Disclosure | 2013-03-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2503 is a medium vulnerability (CVSS 5.8) in Privoxy, published March 11, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.63%, the 91st percentile. Fixed in privoxy 3.0.21-1.
References
blog.c22.cc/2013/03/11/privoxy-proxy-authentication-credential-exposure-cve-2013-2503
ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.188&view=markup
lists.opensuse.org/opensuse-updates/2013-03/msg00118.html
nvd.nist.gov/vuln/detail/CVE-2013-2503
github.com/advisories/GHSA-xwv2-6j43-gjcx
security-tracker.debian.org/tracker/CVE-2013-2503
ubuntu.com/security/CVE-2013-2503
cve.org/CVERecord?id=CVE-2013-2503