Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2006-3918 — Cross-site Scripting in Apache Http Server

CWE-79 — Cross-site Scripting16 documents9 sources
Severity
4.3MEDIUMNVD
EPSS
91.4%
top 0.34%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
5
Apache Http ServerCanonical Ubuntu LinuxDebian Linux+2 more
Timeline
PublishedJul 28
Latest updateMay 3

Description

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶NVDapache/http_server1.3.3 — 1.3.35

Also affects: Debian Linux 3.1, Ubuntu Linux 6.06, 6.10, 7.04, 7.10

Patches

Patch: secunia.com ↗Patch: secunia.com ↗Patch: secunia.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-67m9-fpj8-vgmv: http_protocol↗2022-05-03
▶
OSV
CVE-2006-3918: http_protocol↗2006-07-28
▶
CVEList
CVE-2006-3918: http_protocol↗2006-07-28
▶

💥Exploits & PoCs

2
Exploit-DB
Oracle HTTP Server - Cross-Site Scripting Header Injection↗2011-06-13
▶
Exploit-DB
Apache 1.3.35/2.0.58/2.2.2 - Arbitrary HTTP Request Headers Security↗2006-08-24
▶

📋Vendor Advisories

4
Ubuntu
Apache vulnerabilities↗2008-02-04
▶
Red Hat
httpd: Garbage before http method name is not escaped in a reply in case of errorneous request↗2007-11-30
▶
Red Hat
httpd: Expect header XSS↗2006-05-08
▶
Debian
CVE-2006-3918: apache2 - http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0....↗2006
▶

💬Community

6
Bugzilla
CVE-2007-6203 httpd: Garbage before http method name is not escaped in a reply in case of errorneous request↗2007-12-04
▶
Bugzilla
CVE-2005-3352, CVE-2006-3918 apache security issues↗2006-09-25
▶
Bugzilla
CVE-2006-3918 Expect header XSS↗2006-08-25
▶
Bugzilla
CVE-2006-3918 Expect header XSS↗2006-08-25
▶
Bugzilla
CVE-2006-3918 httpd: Expect header XSS↗2006-07-31
▶
CVE-2006-3918 — Cross-site Scripting in Apache | cvebase