PT-2007-5645 · Apache+1 · Apache Http Server+1

Maksymilian Arciemowicz · Published 2007-09-14 · Updated 2025-01-17 · CVE-2007-4465

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.2.6

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset when the charset on a server-generated page is not defined. This issue may be attributed to a design limitation of browsers that attempt to perform automatic content type detection.

Recommendations For Apache HTTP Server versions prior to 2.2.6, update to version 2.2.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod autoindex.c module until a patch is available. Avoid using the P parameter in affected API endpoints until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-4465

HPSBUX02365

HPSBUX02431

HPSBUX02465

OPENSUSE-SU-2024:10623-1

RHSA-2007:0911

RHSA-2008:0004

RHSA-2008:0005

RHSA-2008:0006

RHSA-2008:0008

RHSA-2008:0261

RHSA-2008:0523

RHSA-2008:0524

RHSA-2008_0006

RHSA-2008_0008

RHSA-2010:0602

Affected Products

Apache Http Server

Red Hat

References · 126

• http://redhat.com/support/errata/RHSA-2008-0004.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2008:014 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4465 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5625 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005 · Security Note
• http://ubuntu.com/usn/usn-575-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0911.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2168 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2371 · Security Note
• https://osv.dev/vulnerability/CVE-2007-4465 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_61_apache2.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0006.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0599 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0005.html · Vendor Advisory