PT-2008-1554 · Apache+1 · Apache Http Server+1

Publicado

2008-01-02

·

Atualizado

2024-06-15

·

CVE-2007-6421

CVSS v2.0

3.5

Baixa

VetorAV:N/AC:M/Au:S/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.0 through 2.2.6
Description A cross-site scripting (XSS) issue exists in the balancer-manager in mod proxy balancer, allowing remote attackers to inject arbitrary web script or HTML via the ss, wr, or rr parameters, or the URL. This could enable a cross-site scripting attack against an authorized user on sites where mod proxy balancer is enabled.
Recommendations For Apache HTTP Server versions 2.2.0 through 2.2.6, consider disabling the mod proxy balancer module as a temporary workaround until a patch is available. Restrict access to the balancer-manager to minimize the risk of exploitation. Avoid using the ss, wr, or rr parameters in the affected module until the issue is resolved.

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-6421
OPENSUSE-SU-2024:10623-1
RHSA-2008:0008
RHSA-2008:0009
RHSA-2008_0008

Produtos afetados

Apache Http Server
Red Hat