Vulnerability CVE-2008-0455
Published: 2008-01-24   Modified: 2012-02-12

Description:
Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Apache mod_negotiation Xss and Http Response Splitting
Stefano Di Paola
25.01.2008

Type:

CWE-79

 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Apache -> Http server 

 References:
http://rhn.redhat.com/errata/RHSA-2012-1591.html
http://rhn.redhat.com/errata/RHSA-2012-1592.html
http://rhn.redhat.com/errata/RHSA-2012-1594.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
https://exchange.xforce.ibmcloud.com/vulnerabilities/39867
Copyright 2024, cxsecurity.com

 

Back to Top