PT-2002-1856 · Apache · Apache+1

Published 2002-10-02 · Updated 2021-06-06 · CVE-2002-0840

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Apache versions 1.3.x up to 1.3.26 Apache versions 2.0 before 2.0.43

Description: A cross-site scripting (XSS) issue exists in the default error page of Apache, allowing remote attackers to execute script as other web page visitors via the Host: header when UseCanonicalName is "Off" and support for wildcard DNS is present.

Recommendations: For Apache versions 1.3.x up to 1.3.26, update to a version later than 1.3.26 to resolve the issue. For Apache versions 2.0 before 2.0.43, update to version 2.0.43 or later to resolve the issue. As a temporary workaround, consider setting UseCanonicalName to "On" to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-0840

DSA-187

DSA-188

DSA-195

Affected Products

Apache

Apache Http Server

References · 44

• 🔥 https://exploit-db.com/exploits/21885 · Exploit
• https://osv.dev/vulnerability/CVE-2002-0840 · Vendor Advisory
• http://online.securityfocus.com/advisories/4617 · Vendor Advisory
• http://debian.org/security/2002/dsa-188 · Vendor Advisory
• http://linuxsecurity.com/advisories/other_advisory-2414.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-251.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2002-0840 · Vendor Advisory
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-068.php · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-243.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-248.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0840 · Security Note
• http://redhat.com/support/errata/RHSA-2003-106.html · Vendor Advisory
• http://debian.org/security/2002/dsa-195 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20021105-02-I · Vendor Advisory
• http://debian.org/security/2002/dsa-187 · Vendor Advisory