vulnwire
6.8med

CVE-2002-08401 exploit

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalNa…

Published 24 y ago · modified 4 mo ago · JSON

CVSS
6.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
95.1%
percentile 100%
Public exploits
1
Exploit-DB

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.

Exploit prediction (EPSS)

95.09% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-21885 Apache 1.3/2.0.x - Server Side Include Cross-Site Scripting · remote · 2002-10-02

CVSS scores

Assigned byVersionScoreVector
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Technology feeds
Apache HTTP Server (RSS, critical only) · Oracle Database (RSS, critical only)

References

  • debian.org /security/2002/dsa-188 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • marc.info /?l=apache-httpd-announce&m=103367938230488&w=2 · x_refsource_CONFIRM, x_transferred
  • linuxsecurity.com /advisories/other_advisory-2414.html · vendor-advisory, x_refsource_ENGARDE, x_transferred
  • online.securityfocus.com /advisories/4617 · vendor-advisory, x_refsource_HP, x_transferred
  • debian.org /security/2002/dsa-187 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • apacheweek.com /issues/02-10-04 · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2002/dsa-195 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • marc.info /?l=bugtraq&m=103376585508776&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • linux-mandrake.com /en/security/2002/MDKSA-2002-068.php · vendor-advisory, x_refsource_MANDRAKE, x_transferred
  • distro.conectiva.com.br /atualizacoes/?id=a&anuncio=000530 · vendor-advisory, x_refsource_CONECTIVA, x_transferred
  • archives.neohapsis.com /archives/bugtraq/2002-10/0254.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • marc.info /?l=bugtraq&m=103357160425708&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • redhat.com /support/errata/RHSA-2002-243.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • osvdb.org /862 · vdb-entry, x_refsource_OSVDB, x_transferred
  • redhat.com /support/errata/RHSA-2002-222.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • redhat.com /support/errata/RHSA-2003-106.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • redhat.com /support/errata/RHSA-2002-251.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/10241 · vdb-entry, x_refsource_XF, x_transferred
  • archives.neohapsis.com /archives/vulnwatch/2002-q4/0003.html · mailing-list, x_refsource_VULNWATCH, x_transferred
  • kb.cert.org /vuls/id/240329 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • securityfocus.com /bid/5847 · vdb-entry, x_refsource_BID, x_transferred
  • redhat.com /support/errata/RHSA-2002-248.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • redhat.com /support/errata/RHSA-2002-244.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.apache.org /thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apach · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apach · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rd00b45b93fda4a5bd013b28587207d0e00f99f6e3308dbb6025f3b01%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.