2.6

CVE-2012-2687

Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ HTTP Server Version2.2.0
Apache ≫ HTTP Server Version2.2.1
Apache ≫ HTTP Server Version2.2.2
Apache ≫ HTTP Server Version2.2.3
Apache ≫ HTTP Server Version2.2.4
Apache ≫ HTTP Server Version2.2.6
Apache ≫ HTTP Server Version2.2.8
Apache ≫ HTTP Server Version2.2.9
Apache ≫ HTTP Server Version2.2.10
Apache ≫ HTTP Server Version2.2.11
Apache ≫ HTTP Server Version2.2.12
Apache ≫ HTTP Server Version2.2.13
Apache ≫ HTTP Server Version2.2.14
Apache ≫ HTTP Server Version2.2.15
Apache ≫ HTTP Server Version2.2.16
Apache ≫ HTTP Server Version2.2.17
Apache ≫ HTTP Server Version2.2.18
Apache ≫ HTTP Server Version2.2.19
Apache ≫ HTTP Server Version2.2.20
Apache ≫ HTTP Server Version2.2.21
Apache ≫ HTTP Server Version2.2.22
Apache ≫ HTTP Server Version2.2.23
Apache ≫ HTTP Server Version2.4.0
Apache ≫ HTTP Server Version2.4.1
Apache ≫ HTTP Server Version2.4.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 4.72% 0.889
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 2.6 4.9 2.9
AV:N/AC:H/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.