CVE-2004-2171 Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting error page.
MediumCVSS 4.3
EPSS 3.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting error page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cherokee httpd | = 0.1 | No fix listed |
| cherokee httpd | = 0.1.5 | No fix listed |
| cherokee httpd | = 0.1.6 | No fix listed |
| cherokee httpd | = 0.2 | No fix listed |
| cherokee httpd | = 0.2.5 | No fix listed |
| cherokee httpd | = 0.2.6 | No fix listed |
| cherokee httpd | = 0.2.7 | No fix listed |
| cherokee httpd | = 0.4.6 | No fix listed |
| cherokee httpd | = 0.4.7 | No fix listed |
References
- 10701 exploit patch third-party-advisory
- 3707 patch vdb-entry
- 9496 exploit patch vdb-entry vendor-advisory
- cherokee-error-xss(14936) vdb-entry