PT-2008-1554 · Apache+1 · Apache Http Server+1

Published 2008-01-02 · Updated 2024-06-15 · CVE-2007-6421

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.0 through 2.2.6

Description A cross-site scripting (XSS) issue exists in the balancer-manager in mod proxy balancer, allowing remote attackers to inject arbitrary web script or HTML via the ss, wr, or rr parameters, or the URL. This could enable a cross-site scripting attack against an authorized user on sites where mod proxy balancer is enabled.

Recommendations For Apache HTTP Server versions 2.2.0 through 2.2.6, consider disabling the mod proxy balancer module as a temporary workaround until a patch is available. Restrict access to the balancer-manager to minimize the risk of exploitation. Avoid using the ss, wr, or rr parameters in the affected module until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-6421

OPENSUSE-SU-2024:10623-1

RHSA-2008:0008

RHSA-2008:0009

RHSA-2008_0008

Affected Products

Apache Http Server

Red Hat

References · 82

• https://security-tracker.debian.org/tracker/CVE-2007-6421 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-6421 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10623-1 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00562.html · Vendor Advisory
• http://ubuntu.com/usn/usn-575-1 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00541.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:016 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-6421 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0009.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6421 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0008.html · Vendor Advisory
• http://secunia.com/advisories/28526 · Note
• https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2007-6421 · Note