Every CVE Search/ Get API key

CVE-2011-3368

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2...

5.0 MediumPublic exploitFix available

CVE-2011-3368 is a medium vulnerability (CVSS 5.0) in Apache Http Server, published October 5, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 90.7%, the 99th percentile. Fixed in apache2 2.2.21-2.

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

Exploit likelihood

90.7%Down 1.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

Record
CVE-2011-3368
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

Record
CVE-2011-3368
Updated
2026-11-02
EUVDEUVD-2011-3332 No score

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

Record
EUVD-2011-3332
Updated
2026-11-03
GitHub AdvisoriesGHSA-j85c-9w9v-p2p3 No score

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2...

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

Record
GHSA-j85c-9w9v-p2p3
Weakness
CWE-20
Updated
2026-11-02
OSVBELL-CVE-2011-3368 5.0

CVE-2011-3368 does not affect BellSoft software

Record
BELL-CVE-2011-3368
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Updated
2026-11-02
OSV No score

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

Record
CVE-2011-3368
Updated
2026-11-02
OSVDEBIAN-CVE-2011-3368 No score

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

Record
DEBIAN-CVE-2011-3368
Updated
2026-11-02
OSVopenSUSE-SU-2024:10268-1 No score

apache2-2.4.23-4.1 on GA media

These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10268-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Debian:12
 before 2.2.21-2
2.2.21-2
apache2
Debian:13
 before 2.2.21-2
2.2.21-2
apache2
Debian:14
 before 2.2.21-2
2.2.21-2
apache2
Debian:6.0
 before 2.2.16-6+squeeze6, plus listed versions
2.2.16-62.2.16-6+squeeze12.2.16-6+squeeze1~bpo50+12.2.16-6+squeeze22.2.16-6+squeeze2~bpo50+12.2.16-6+squeeze32.2.16-6+squeeze42.2.16-6+squeeze4~bpo50+1
2.2.16-6+squeeze6
apache2
Debian:5.0
 before 2.2.9-10+lenny12, plus listed versions
2.2.9-10+lenny102.2.9-10+lenny112.2.9-10+lenny22.2.9-10+lenny32.2.9-10+lenny4
Show 5 moreShow less
2.2.9-10+lenny52.2.9-10+lenny62.2.9-10+lenny72.2.9-10+lenny82.2.9-10+lenny9
2.2.9-10+lenny12
httpd
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-9.el6_1.3
0:2.2.15-9.el6_1.3
httpd-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-9.el6_1.3
0:2.2.15-9.el6_1.3
httpd-devel
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-9.el6_1.3
0:2.2.15-9.el6_1.3
httpd-manual
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-9.el6_1.3
0:2.2.15-9.el6_1.3
httpd-tools
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-9.el6_1.3
0:2.2.15-9.el6_1.3
Show 47 moreShow less
Affected packages
PackageAffectedFixed
mod_ssl
Red Hat:enterprise_linux:6::server
 before 1:2.2.15-9.el6_1.3
1:2.2.15-9.el6_1.3
httpd
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-devel
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-manual
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-suexec
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
mod_ssl
Red Hat:enterprise_linux:4::as
 before 1:2.0.52-49.ent
1:2.0.52-49.ent
httpd
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-devel
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-manual
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-suexec
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
mod_ssl
Red Hat:enterprise_linux:4::desktop
 before 1:2.0.52-49.ent
1:2.0.52-49.ent
httpd
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-devel
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-manual
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-suexec
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
mod_ssl
Red Hat:enterprise_linux:4::es
 before 1:2.0.52-49.ent
1:2.0.52-49.ent
httpd
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-devel
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-manual
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
httpd-suexec
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-49.ent
0:2.0.52-49.ent
mod_ssl
Red Hat:enterprise_linux:4::ws
 before 1:2.0.52-49.ent
1:2.0.52-49.ent
httpd
Red Hat:enterprise_linux:5::client
 before 0:2.2.3-53.el5_7.3
0:2.2.3-53.el5_7.3
httpd-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:2.2.3-53.el5_7.3
0:2.2.3-53.el5_7.3
mod_ssl
Red Hat:enterprise_linux:5::client
 before 1:2.2.3-53.el5_7.3
1:2.2.3-53.el5_7.3
httpd
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-53.el5_7.3
0:2.2.3-53.el5_7.3
httpd-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-53.el5_7.3
0:2.2.3-53.el5_7.3
httpd-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-53.el5_7.3
0:2.2.3-53.el5_7.3
httpd-manual
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-53.el5_7.3
0:2.2.3-53.el5_7.3
httpd
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-53.el5_7.3
0:2.2.3-53.el5_7.3
httpd-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-53.el5_7.3
0:2.2.3-53.el5_7.3
httpd-devel
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-53.el5_7.3
0:2.2.3-53.el5_7.3
httpd-manual
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-53.el5_7.3
0:2.2.3-53.el5_7.3
mod_ssl
Red Hat:enterprise_linux:5::server
 before 1:2.2.3-53.el5_7.3
1:2.2.3-53.el5_7.3
httpd
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:2.2.17-15.4.ep5.el5
0:2.2.17-15.4.ep5.el5
httpd-devel
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:2.2.17-15.4.ep5.el5
0:2.2.17-15.4.ep5.el5
httpd-manual
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:2.2.17-15.4.ep5.el5
0:2.2.17-15.4.ep5.el5
mod_ssl
Red Hat:jboss_enterprise_web_server:1::el5
 before 1:2.2.17-15.4.ep5.el5
1:2.2.17-15.4.ep5.el5
httpd
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:2.2.17-15.4.ep5.el6
0:2.2.17-15.4.ep5.el6
httpd-devel
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:2.2.17-15.4.ep5.el6
0:2.2.17-15.4.ep5.el6
httpd-manual
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:2.2.17-15.4.ep5.el6
0:2.2.17-15.4.ep5.el6
httpd-tools
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:2.2.17-15.4.ep5.el6
0:2.2.17-15.4.ep5.el6
mod_ssl
Red Hat:jboss_enterprise_web_server:1::el6
 before 1:2.2.17-15.4.ep5.el6
1:2.2.17-15.4.ep5.el6
apache2
openSUSE:Tumbleweed
 before 2.4.23-4.1
2.4.23-4.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApache mod_proxy - Reverse Proxy Exposure2011-10-11
MetasploitApache Reverse Proxy Bypass Vulnerability Scanner
PoC in GitHubSECFORCE/CVE-2011-33682017-04-18
PoC in GitHubcolorblindpentester/CVE-2011-33682019-03-22

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

References

Show 159 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open