vulnwire
7.5high

CVE-2002-1157in critical feed

Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled…

Published 24 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
11.1%
percentile 96%
Public exploits
0
none known

Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.

Exploit prediction (EPSS)

11.12% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

References

  • archives.neohapsis.com /archives/bugtraq/2002-10/0374.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • redhat.com /support/errata/RHSA-2002-243.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securityfocus.com /bid/6029 · vdb-entry, x_refsource_BID, x_transferred
  • redhat.com /support/errata/RHSA-2002-222.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • redhat.com /support/errata/RHSA-2003-106.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • redhat.com /support/errata/RHSA-2002-251.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • debian.org /security/2002/dsa-181 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • osvdb.org /2107 · vdb-entry, x_refsource_OSVDB, x_transferred
  • linuxsecurity.com /advisories/other_advisory-2512.html · vendor-advisory, x_refsource_ENGARDE, x_transferred
  • iss.net /security_center/static/10457.php · vdb-entry, x_refsource_XF, x_transferred
  • linux-mandrake.com /en/security/2002/MDKSA-2002-072.php · vendor-advisory, x_refsource_MANDRAKE, x_transferred
  • online.securityfocus.com /archive/1/296753 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • distro.conectiva.com.br /atualizacoes/?id=a&anuncio=000541 · vendor-advisory, x_refsource_CONECTIVA, x_transferred
  • redhat.com /support/errata/RHSA-2002-248.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • redhat.com /support/errata/RHSA-2002-244.html · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.