Search for vulnerabilities
Vulnerability ID | VCID-t7je-jfdd-aaar |
Aliases |
CVE-2007-6750
|
Summary | The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15. |
Status | Published |
Exploitability | 2.0 |
Weighted Severity | 6.2 |
Risk | 10.0 |
Affected and Fixed Packages | Package Details |
CWE-399 | Resource Management Errors |
Data source | Metasploit |
---|---|
Description | Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to-but never completing-the request. Affected servers will keep these connections open, filling their maximum concurrent connection pool, eventually denying additional connection attempts from clients. |
Note | {} |
Ransomware campaign use | Unknown |
Source publication date | June 17, 2009 |
Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/dos/http/slowloris.py |
Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
Percentile | 0.88128 |
EPSS Score | 0.01696 |
Published At | Nov. 1, 2024, midnight |
Date | Actor | Action | Source | VulnerableCode Version |
---|---|---|---|---|
There are no relevant records. |