CVE-2013-1862

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 24.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-06-10 · updated 2026-06-16

Description

mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.

Affected products

Apache HTTP Server: from 2.0.0 before 2.0.65; from 2.2.0 before 2.2.25 — fixed in 2.0.65, 2.2.25
Canonical Ubuntu Linux: 10.04, 12.04, 12.10, 13.04
Opensuse: 11.4, 12.2, 12.3
Oracle Corporation Oracle HTTP Server: 10.1.3.5.0, 11.1.1.7.0, 12.1.2.0, 12.1.3.0
RedHat Enterprise Linux Desktop: 5.0, 6.0
RedHat Enterprise Linux Eus: 5.9, 6.4
RedHat Enterprise Linux Server: 5.0, 6.0
RedHat Enterprise Linux Server Aus: 5.9, 6.4
RedHat Enterprise Linux Workstation: 5.0, 6.0
Red Hat JBoss EAP: 6.0.0, 6.4.0

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.0.65, 2.2.25. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2013-1862 or the next vulnerability affects your stack