PT-2008-1553 · Apache+1 · Apache Http Server+1

Published 2008-01-09 · Updated 2024-06-15 · CVE-2007-6420

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.x

Description A cross-site request forgery (CSRF) issue exists in the balancer-manager of mod proxy balancer, allowing remote attackers to gain privileges via unspecified vectors. The mod proxy balancer provides an administrative interface that could be vulnerable to CSRF attacks.

Recommendations For Apache HTTP Server version 2.2.x, consider disabling the balancer-manager interface in mod proxy balancer as a temporary workaround until a patch is available. Restrict access to the administrative interface of mod proxy balancer to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2007-6420

HPSBUX02401

OPENSUSE-SU-2024:10623-1

RHSA-2008:0966

Affected Products

Apache Http Server

Hp-Ux

References · 91

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/tomcat_utf8_traversal.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/trendmicro_dlp_traversal.rb · Exploit
• https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1232 · Security Note
• https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E · Vendor Advisory
• https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6420 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2364 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10623-1 · Vendor Advisory
• https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E · Vendor Advisory
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Vendor Advisory
• http://ubuntu.com/usn/USN-731-1 · Vendor Advisory
• https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E · Vendor Advisory
• https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0966.html · Vendor Advisory