CVE-2007-6420 Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
MediumCVSS 4.3
EPSS 9.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | = 2.2.0 | No fix listed |
| Apache HTTP Server | = 2.2.2 | No fix listed |
| Apache HTTP Server | = 2.2.3 | No fix listed |
| Apache HTTP Server | = 2.2.4 | No fix listed |
| Apache HTTP Server | = 2.2.5 | No fix listed |
| Apache HTTP Server | = 2.2.6 | No fix listed |
| Apache HTTP Server | = 2.2.8 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 7.10 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
| debian/apache2(Debian:12) | < 2.2.9-1 | 2.2.9-1 |
| debian/apache2(Debian:13) | < 2.2.9-1 | 2.2.9-1 |
| debian/apache2(Debian:14) | < 2.2.9-1 | 2.2.9-1 |
References
- APPLE-SA-2008-10-09 mailing-list vendor-advisory
- SUSE-SR:2008:024 broken-link vendor-advisory
- HPSBUX02401 third-party-advisory vendor-advisory
- 31026 not-applicable third-party-advisory
- 32222 not-applicable third-party-advisory
- 33797 not-applicable third-party-advisory
- 34219 not-applicable third-party-advisory
- GLSA-200807-06 third-party-advisory vendor-advisory
- 3523 third-party-advisory
- support.apple.com third-party-advisory
- RHSA-2008:0966 third-party-advisory vendor-advisory
- 20080110 SecurityReason - Apache2 CSRF, XSS, Memory Corruption and Denial of Service Vulnerability mailing-list third-party-advisory vdb-entry
- 20080729 rPSA-2008-0236-1 httpd mod_ssl mailing-list third-party-advisory vdb-entry
- 27236 patch third-party-advisory vdb-entry
- 31681 third-party-advisory vdb-entry
- USN-731-1 third-party-advisory vendor-advisory
- ADV-2008-2780 permissions-required vdb-entry
- ADV-2009-0320 permissions-required vdb-entry
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list patch vendor-advisory
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list patch vendor-advisory
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list patch vendor-advisory
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list patch vendor-advisory
- [httpd-cvs] 20210330 svn commit: r1888194 [5/13] - /httpd/site/trunk/content/security/json/ mailing-list patch vendor-advisory
- [httpd-cvs] 20210330 svn commit: r1073139 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list patch vendor-advisory
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list patch vendor-advisory
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list patch vendor-advisory
- [httpd-cvs] 20210330 svn commit: r1073149 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list patch vendor-advisory
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list patch vendor-advisory
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list vendor-advisory
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list patch vendor-advisory
- oval:org.mitre.oval:def:8371 broken-link signature vdb-entry
- Debian Security Tracker CVE-2007-6420 vendor-advisory