CVE-2019-12523

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Nov 26, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-125249.8An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be deniCVE-2019-125259.8An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses CVE-2019-125269.8An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data fCVE-2019-125278.8An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global bufferCVE-2019-125287.5An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memoryCVE-2019-125295.9An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic AutCVE-2019-12537.8An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerabCVE-2019-125309.8Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.CVE-2019-125327.8Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or inforCVE-2019-125376.1An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field.CVE-2019-125386.1An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field.CVE-2019-125396.1An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a dif
CVE-2019-12523: Critical severity, CVSS 9.1 | Vulnix