CVE-2010-2068: apache http_server

Modified

Published 18-06-2010Last modified 07-08-2024

Vulnerability summary

CVE-2010-2068 is a medium (CVSS 5.0) vulnerability in apache http_server. EPSS estimates a 16.00% chance of exploitation in the next 30 days, higher than 96.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

16.00%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:10268-1

Timeline

18-06-2010
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

16.00%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 16.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Apache1 product

http_serverEOL2.2.9 | 2.2.10 | 2.2.11 | 2.2.12 | 2.2.13 | 2.2.14 | 2.2.15 | 2.3.4:alpha | 2.3.5:alpha

1 vendor · 1 product

References

41 links

www.vupen.com/english/advisories/2010/1436VDB EntryX Refsource VUPENPatchVendor Advisory
mail-archives.apache.org/mod_mbox/httpd-announce/201006.mbox/%3C4C12933D.4060400%40apache.org%3EMailing ListX Refsource MLIST
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6931VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/40824Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11491VDB EntrySignatureX Refsource OVAL
www.securityfocus.com/archive/1/511809/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/41722Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=nas352ca0ac9460f9b8886257777005dd0e4Vendor AdvisoryX Refsource AIXAPAR
www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.htmlX Refsource CONFIRM
lists.apple.com/archives/security-announce/2011/Mar/msg00006.htmlVendor AdvisoryX Refsource APPLE

Show all 41 references

secunia.com/advisories/41490Third Party AdvisoryX Refsource SECUNIA
marc.info?l=apache-announce&m=128009718610929&w=2Mailing ListX Refsource MLIST
www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995Vendor AdvisoryX Refsource HP
www.ibm.com/support/docview.wss?uid=swg1PM16366Vendor AdvisoryX Refsource AIXAPAR
securitytracker.com/id?1024096VDB EntryX Refsource SECTRACK
www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.htmlX Refsource CONFIRM
httpd.apache.org/security/vulnerabilities_22.htmlX Refsource CONFIRMPatchVendor Advisory
www.apache.org/dist/httpd/patches/apply_to_2.2.15/CVE-2010-2068-r953616.patchX Refsource CONFIRMPatch
secunia.com/advisories/40206Third Party AdvisoryX Refsource SECUNIAVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/59413VDB EntryX Refsource XF
www.redhat.com/support/errata/RHSA-2011-0896.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/41480Third Party AdvisoryX Refsource SECUNIA
www.apache.org/dist/httpd/patches/apply_to_2.3.5/CVE-2010-2068-r953418.patchX Refsource CONFIRMPatch
www.mandriva.com/security/advisories?name=MDVSA-2013:150Vendor AdvisoryX Refsource MANDRIVA
www.securityfocus.com/bid/40827VDB EntryX Refsource BID
support.apple.com/kb/HT4581X Refsource CONFIRM
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST