CVE-2013-2503

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-03-11 · updated 2026-06-16
Weakness: CWE-20

Description

Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.

Affected products

privoxy: through 3.0.20; 2.9.0-pre-alpha, 2.9.1-pre-alpha, 2.9.2-pre-alpha, 2.9.3-pre-alpha, 2.9.11-alpha, 2.9.11-beta (+24)

References

http://blog.c22.cc/2013/03/11/privoxy-proxy-authentication-credential-exposure-cve-2013-2503/
http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.188&view=markup
http://lists.opensuse.org/opensuse-updates/2013-03/msg00118.html
http://blog.c22.cc/2013/03/11/privoxy-proxy-authentication-credential-exposure-cve-2013-2503/
http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.188&view=markup
http://lists.opensuse.org/opensuse-updates/2013-03/msg00118.html

Get alerted when CVE-2013-2503 or the next vulnerability affects your stack