CVE-2013-2503 Security feature bypass in n/a

What is CVE-2013-2503?

CVE-2013-2503 is a medium-severity vulnerability in n/a, published on 11 Mar 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.

Weakness: CWE-20

Which versions are affected by CVE-2013-2503?

It affects 1 product.

Products include Privoxy Privoxy.

How do I fix CVE-2013-2503?

Upgrade to a fixed version.

Is CVE-2013-2503 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-2503 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2019-3699 Local privilege escalation from user privoxy to root High 7.7
• CVE-2021-44540 Denial of service in Privoxy High 7.5
• CVE-2021-44541 Denial of service in Privoxy High 7.5
• CVE-2021-44542 Denial of service in Privoxy High 7.5
• CVE-2021-20209 Denial of service in privoxy High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-2503, GHSA-xwv2-6j43-gjcx.