NetSight
IP …
medium5.8Public exploit code

CVE-2013-2503

Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for r…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.

Affected products

VendorProductAffected versions
PrivoxyPrivoxy
through 3.0.20
Versions 2.9.0, 2.9.1, 2.9.2, 2.9.3, 2.9.11

Weakness classification

CWE-20

References