CVE-2007-4465 Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitr...
MediumCVSS 4.3
EPSS 26.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | >= 2.0.0, < 2.0.61 | 2.0.61 |
| Apache HTTP Server | >= 2.2.0, < 2.2.6 | 2.2.6 |
| debian/apache2(Debian:12) | < 2.2.6-1 | 2.2.6-1 |
| debian/apache2(Debian:13) | < 2.2.6-1 | 2.2.6-1 |
| debian/apache2(Debian:14) | < 2.2.6-1 | 2.2.6-1 |
References
- bugs.gentoo.org third-party-advisory
- HPSBUX02365 broken-link vendor-advisory
- APPLE-SA-2008-05-28 mailing-list vendor-advisory
- SSRT090085 third-party-advisory vdb-entry vendor-advisory
- HPSBUX02465 mailing-list third-party-advisory vendor-advisory
- 26842 broken-link third-party-advisory
- 26952 broken-link third-party-advisory
- 27563 broken-link third-party-advisory
- 27732 broken-link third-party-advisory
- 28467 broken-link third-party-advisory
- 28471 broken-link third-party-advisory
- 28607 broken-link third-party-advisory
- 28749 broken-link third-party-advisory
- 30430 broken-link third-party-advisory
- 31651 broken-link third-party-advisory
- 33105 broken-link third-party-advisory
- 35650 broken-link third-party-advisory
- GLSA-200711-06 third-party-advisory vendor-advisory
- 20070912 Apache2 Undefined Charset UTF-7 XSS Vulnerability third-party-advisory
- 3113 third-party-advisory
- 1019194 third-party-advisory vdb-entry
- support.avaya.com third-party-advisory
- www.apache.org broken-link
- www.fujitsu.com third-party-advisory
- MDVSA-2008:014 third-party-advisory vendor-advisory
- SUSE-SA:2007:061 third-party-advisory vendor-advisory
- FEDORA-2007-2214 broken-link vendor-advisory
- RHSA-2007:0911 broken-link vendor-advisory
- RHSA-2008:0004 broken-link vendor-advisory
- RHSA-2008:0005 broken-link vendor-advisory
- RHSA-2008:0006 broken-link vendor-advisory
- RHSA-2008:0008 broken-link vendor-advisory
- RHSA-2008:0261 broken-link vendor-advisory
- 20070912 Apache2 Undefined Charset UTF-7 XSS Vulnerability broken-link mailing-list third-party-advisory vdb-entry
- 25653 patch third-party-advisory vdb-entry
- USN-575-1 third-party-advisory vendor-advisory
- TA08-150A third-party-advisory us-government-resource
- ADV-2008-1697 permissions-required third-party-advisory vdb-entry
- apache-utf7-xss(36586) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:10929 broken-link signature vdb-entry
- oval:org.mitre.oval:def:6089 broken-link signature vdb-entry
- FEDORA-2007-707 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2007-4465 vendor-advisory
- bugs.debian.org issue-tracking