CVE-2018-11783

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-03-07 · updated 2026-06-17
Weakness: CWE-200

Description

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.

Affected products

Apache Software Foundation Apache Traffic Server: from 6.0.0 through 6.0.3; from 7.0.0 through 7.1.5; from 8.0.0 through 8.0.1

References

http://www.securityfocus.com/bid/107032
https://lists.apache.org/thread.html/4f102f943935476732fb1fb653d687c7b69d29d9792f0d6cf72c505e%40%3Cannounce.trafficserver.apache.org%3E
http://www.securityfocus.com/bid/107032
https://lists.apache.org/thread.html/4f102f943935476732fb1fb653d687c7b69d29d9792f0d6cf72c505e%40%3Cannounce.trafficserver.apache.org%3E

Get alerted when CVE-2018-11783 or the next vulnerability affects your stack