CVE-2009-0804

MEDIUM 5.4CVE-2009-0804 · Published 04/03/2009 · updated 16/06/2026

In short

CVE-2009-0804 is a MEDIUM (CVSS 5.4) vulnerability affecting ziproxy (ziproxy).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ziproxy ziproxy	`= 2.6.0`	No fix yet

Description

Ziproxy 2.6.0, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.

References

kb.cert.org/vuls/id/435052 · Third Party Advisory
kb.cert.org/vuls/id/MAPG-7N9GN8 · Vendor Advisory
securityfocus.com/bid/33858

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free