vulnwire
2.6low

CVE-2003-1581

The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text int…

Published 16 y ago · modified 4 mo ago · JSON

CVSS
2.6
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.1%
percentile 88%
Public exploits
0
none known

The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

Exploit prediction (EPSS)

3.08% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.02.6AV:N/AC:H/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
Technology feeds
Apache HTTP Server (RSS, critical only)

References

  • securityfocus.com /archive/1/313867 · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.