CVE-2002-0840

Fixed in a distro release EPSS 95%

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.

Published 2004-09-01 · CVE record · OSV

Products: apache http_server, oracle application_server, oracle database_server, oracle8i, oracle9i

Distro releases