PT-2008-1553 · Apache+1 · Apache Http Server+1

Publicado 2008-01-09 · Atualizado 2024-06-15 · CVE-2007-6420

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.x

Description A cross-site request forgery (CSRF) issue exists in the balancer-manager of mod proxy balancer, allowing remote attackers to gain privileges via unspecified vectors. The mod proxy balancer provides an administrative interface that could be vulnerable to CSRF attacks.

Recommendations For Apache HTTP Server version 2.2.x, consider disabling the balancer-manager interface in mod proxy balancer as a temporary workaround until a patch is available. Restrict access to the administrative interface of mod proxy balancer to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2007-6420

HPSBUX02401

OPENSUSE-SU-2024:10623-1

RHSA-2008:0966

Produtos afetados

Apache Http Server

Hp-Ux

Referências · 91

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/tomcat_utf8_traversal.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/trendmicro_dlp_traversal.rb · Exploit
• https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1232 · Nota de Segurança
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E · Nota
• http://vupen.com/english/advisories/2008/2780 · Nota
• https://suse.com/security/cve/CVE-2007-6388 · Nota
• https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-10092 · Nota
• https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2005-3357 · Nota
• https://suse.com/security/cve/CVE-2019-9517 · Nota
• https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E · Nota