CVE-2005-3352 Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTM...
MediumCVSS 4.3
EPSS 73.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | < 1.3.35 | 1.3.35 |
| Apache HTTP Server | >= 2.0, < 2.0.56 | 2.0.56 |
| Apache HTTP Server | = 2.2 | No fix listed |
| debian/apache2(Debian:12) | < 2.0.55-4 | 2.0.55-4 |
| debian/apache2(Debian:13) | < 2.0.55-4 | 2.0.55-4 |
| debian/apache2(Debian:14) | < 2.0.55-4 | 2.0.55-4 |
References
- docs.info.apple.com broken-link
- SSRT071293 broken-link vendor-advisory
- issues.apache.org issue-tracking
- APPLE-SA-2008-05-28 mailing-list vendor-advisory
- APPLE-SA-2008-03-18 mailing-list vendor-advisory
- SUSE-SR:2007:011 broken-link vendor-advisory
- SUSE-SR:2006:004 broken-link vendor-advisory
- SSRT090208 mailing-list third-party-advisory vendor-advisory
- RHSA-2006:0159 third-party-advisory vendor-advisory
- RHSA-2006:0692 broken-link vendor-advisory
- 17319 not-applicable third-party-advisory url-repurposed
- 18008 not-applicable third-party-advisory
- 18333 not-applicable third-party-advisory
- 18339 not-applicable third-party-advisory
- 18340 not-applicable third-party-advisory
- 18429 not-applicable third-party-advisory
- 18517 not-applicable third-party-advisory
- 18526 not-applicable third-party-advisory
- 18585 not-applicable third-party-advisory
- 18743 not-applicable third-party-advisory
- 19012 not-applicable third-party-advisory
- 20046 not-applicable third-party-advisory
- 20670 not-applicable third-party-advisory
- 21744 not-applicable third-party-advisory
- 22140 third-party-advisory
- 22368 third-party-advisory
- 22388 third-party-advisory
- 22669 third-party-advisory
- 23260 third-party-advisory
- 25239 third-party-advisory
- 29420 third-party-advisory
- 29849 third-party-advisory
- 30430 third-party-advisory
- 1015344 patch third-party-advisory vdb-entry
- SSA:2006-130-01 third-party-advisory vendor-advisory
- SSA:2006-129-01 third-party-advisory vendor-advisory
- 102662 third-party-advisory vendor-advisory
- 102663 third-party-advisory vendor-advisory
- PK16139 third-party-advisory vendor-advisory
- PK25355 third-party-advisory vendor-advisory
- DSA-1167 third-party-advisory vendor-advisory
- GLSA-200602-03 third-party-advisory vendor-advisory
- SUSE-SA:2006:043 third-party-advisory vendor-advisory
- OpenPKG-SA-2005.029 third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- FEDORA-2006-052 third-party-advisory vendor-advisory
- RHSA-2006:0158 third-party-advisory vendor-advisory
- FLSA-2006:175406 third-party-advisory vdb-entry vendor-advisory
- HPSBUX02145 third-party-advisory vdb-entry vendor-advisory
- SSRT061269 third-party-advisory vdb-entry vendor-advisory
- SSRT061265 third-party-advisory vdb-entry vendor-advisory
- 15834 third-party-advisory vdb-entry
- TSLSA-2005-0074 third-party-advisory vendor-advisory
- USN-241-1 third-party-advisory vendor-advisory
- TA08-150A third-party-advisory us-government-resource
- ADV-2005-2870 third-party-advisory vdb-entry
- ADV-2006-2423 third-party-advisory vdb-entry
- ADV-2006-3995 third-party-advisory vdb-entry
- ADV-2006-4015 third-party-advisory vdb-entry
- ADV-2006-4300 third-party-advisory vdb-entry
- ADV-2006-4868 third-party-advisory vdb-entry
- ADV-2008-0924 third-party-advisory vdb-entry
- ADV-2008-1246 third-party-advisory vdb-entry
- ADV-2008-1697 third-party-advisory vdb-entry
- MDKSA-2006:007 third-party-advisory vendor-advisory
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list third-party-advisory
- oval:org.mitre.oval:def:10480 broken-link signature vdb-entry
- Debian Security Tracker CVE-2005-3352 vendor-advisory
- bugs.debian.org issue-tracking