CVE-2007-6203
Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 80.7%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 80.75% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- apache/http server
- Source
- cve@mitre.org
References
- http://docs.info.apple.com/article.html?artnum=307562
- http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html
- http://marc.info/?l=bugtraq&m=125631037611762&w=2
- http://marc.info/?l=bugtraq&m=129190899612998&w=2
- http://procheckup.com/Vulnerability_PR07-37.phpExploit
- http://secunia.com/advisories/27906Vendor Advisory
- http://secunia.com/advisories/28196Vendor Advisory
- http://secunia.com/advisories/29348Vendor Advisory
- http://secunia.com/advisories/29420Vendor Advisory
- http://secunia.com/advisories/29640Vendor Advisory
- http://secunia.com/advisories/30356Vendor Advisory
- http://secunia.com/advisories/30732Vendor Advisory
- http://secunia.com/advisories/33105Vendor Advisory
- http://secunia.com/advisories/34219Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200803-19.xml
- http://securityreason.com/securityalert/3411
- http://www-1.ibm.com/support/docview.wss?uid=swg1PK57952
- http://www-1.ibm.com/support/docview.wss?uid=swg24019245
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.html
- http://www.securityfocus.com/archive/1/484410/100/0/threaded
- http://www.securityfocus.com/bid/26663Exploit
- http://www.securitytracker.com/id?1019030
- http://www.ubuntu.com/usn/USN-731-1
- http://www.vupen.com/english/advisories/2007/4060
- http://www.vupen.com/english/advisories/2007/4301
- http://www.vupen.com/english/advisories/2008/0924/references
- http://www.vupen.com/english/advisories/2008/1623/references
- http://www.vupen.com/english/advisories/2008/1875/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38800
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.