CVE-2001-1556

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Dec 31, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-15577.5Buffer overflow in ftpd in IBM AIX 4.3 and 5.1 allows attackers to gain privileges.CVE-2001-15585.0Unknown vulnerability in IP defragmenter (frag2) in Snort before 1.8.3 allows attackers to cause a denial of service (crash).CVE-2001-15595.5The uipc system calls (uipc_syscalls.c) in OpenBSD 2.9 and 3.0 provide user mode return instead of versus rval kernel mode values to the fdr CVE-2001-15602.1Win32k.sys (aka Graphics Device Interface (GDI)) in Windows 2000 and XP allows local users to cause a denial of service (system crash) by ca CVE-2001-15617.2Buffer overflow in Xvt 2.1 in Debian Linux 2.2 allows local users to execute arbitrary code via long (1) -name and (2) -T arguments.CVE-2001-15627.2Format string vulnerability in nvi before 1.79 allows local users to gain privileges via format string specifiers in a filename.CVE-2001-15637.5Unknown vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 allows attackers to access servlet resources. NOTE: due to the CVE-2001-15642.1setrlimit in HP-UX 10.01, 10.10, 10.24, 10.20, 11.00, 11.04 and 11.11 does not properly enforce core file size on processes after setuid or CVE-2001-15652.1Point to Point Protocol daemon (pppd) in MacOS x 10.0 and 10.1 through 10.1.5 provides the username and password on the command line, which CVE-2001-15667.5Format string vulnerability in libvanessa_logger 0.0.1 in Perdition 0.1.8 allows remote attackers to execute arbitrary code via format strin CVE-2001-15675.0Lotus Domino server 5.0.9a and earlier allows remote attackers to bypass security restrictions and view Notes database files and possibly se CVE-2001-15686.4CMG WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate authorities, which allows