6.8

CVE-2002-0840

EPSS 91.95%
Veröffentlicht 11.10.2002 04:00:00
Zuletzt bearbeitet 03.04.2025 01:03:51
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 40

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ HTTP Server Version1.3

Apache ≫ HTTP Server Version1.3.1

Apache ≫ HTTP Server Version1.3.3

Apache ≫ HTTP Server Version1.3.4

Apache ≫ HTTP Server Version1.3.6

Apache ≫ HTTP Server Version1.3.9

Apache ≫ HTTP Server Version1.3.11

Apache ≫ HTTP Server Version1.3.12

Apache ≫ HTTP Server Version1.3.14

Apache ≫ HTTP Server Version1.3.17

Apache ≫ HTTP Server Version1.3.18

Apache ≫ HTTP Server Version1.3.19

Apache ≫ HTTP Server Version1.3.20

Apache ≫ HTTP Server Version1.3.22

Apache ≫ HTTP Server Version1.3.23

Apache ≫ HTTP Server Version1.3.24

Apache ≫ HTTP Server Version1.3.25

Apache ≫ HTTP Server Version1.3.26

Apache ≫ HTTP Server Version2.0

Apache ≫ HTTP Server Version2.0.28

Apache ≫ HTTP Server Version2.0.32

Apache ≫ HTTP Server Version2.0.35

Apache ≫ HTTP Server Version2.0.36

Apache ≫ HTTP Server Version2.0.37

Apache ≫ HTTP Server Version2.0.38

Apache ≫ HTTP Server Version2.0.39

Apache ≫ HTTP Server Version2.0.40

Apache ≫ HTTP Server Version2.0.41

Apache ≫ HTTP Server Version2.0.42

Oracle ≫ Application Server Version1.0.2

Oracle ≫ Application Server Version1.0.2.1s

Oracle ≫ Application Server Version1.0.2.2

Oracle ≫ Application Server Version9.0.2

Oracle ≫ Application Server Version9.0.2 Updater2

Oracle ≫ Application Server Version9.0.2.1

Oracle ≫ Database Server Version8.1.7

Oracle ≫ Database Server Version9.2.1

Oracle ≫ Database Server Version9.2.2

Oracle ≫ Oracle8i Version8.1.7

Oracle ≫ Oracle8i Version8.1.7.1

Oracle ≫ Oracle8i Version8.1.7_.0.0_enterprise

Oracle ≫ Oracle8i Version8.1.7_.1.0_enterprise

Oracle ≫ Oracle9i Version9.0

Oracle ≫ Oracle9i Version9.0.1

Oracle ≫ Oracle9i Version9.0.1.2

Oracle ≫ Oracle9i Version9.0.1.3

Oracle ≫ Oracle9i Version9.0.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	91.95%	0.997

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rd00b45b93fda4a5bd013b28587207d0e00f99f6e3308dbb6025f3b01%40%3Ccvs.httpd.apache.org%3E

http://www.redhat.com/support/errata/RHSA-2003-106.html

http://www.redhat.com/support/errata/RHSA-2002-243.html

http://www.redhat.com/support/errata/RHSA-2002-244.html

http://www.redhat.com/support/errata/RHSA-2002-248.html

http://archives.neohapsis.com/archives/bugtraq/2002-10/0254.html

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000530

http://marc.info/?l=apache-httpd-announce&m=103367938230488&w=2

http://marc.info/?l=bugtraq&m=103376585508776&w=2

http://online.securityfocus.com/advisories/4617

http://www.apacheweek.com/issues/02-10-04

Vendor Advisory

http://www.debian.org/security/2002/dsa-187

http://www.debian.org/security/2002/dsa-188

http://www.debian.org/security/2002/dsa-195

http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-068.php

http://www.linuxsecurity.com/advisories/other_advisory-2414.html

ftp://patches.sgi.com/support/free/security/advisories/20021105-02-I

http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0003.html

http://marc.info/?l=bugtraq&m=103357160425708&w=2

http://www.kb.cert.org/vuls/id/240329

US Government Resource

http://www.osvdb.org/862

http://www.redhat.com/support/errata/RHSA-2002-222.html

http://www.redhat.com/support/errata/RHSA-2002-251.html

http://www.securityfocus.com/bid/5847

https://exchange.xforce.ibmcloud.com/vulnerabilities/10241

https://nvd.nist.gov/vuln/detail/CVE-2002-0840

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2002-0840

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2002-0840

EUVD