CVE-2007-4465
published 2007-09-14CVE-2007-4465: Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
26.19%
97.8th percentile
Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.0.0 < 2.0.61 | 2.0.61 |
| apache | http_server | >= 2.2.0 < 2.2.6 | 2.2.6 |
| debian | apache2 | < apache2 2.2.6-1 (bookworm) | apache2 2.2.6-1 (bookworm) |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_redhat6.1MEDIUM
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7286-985c-74qv: Cross-site scripting (XSS) vulnerability in mod_autoindex
ghsa_unreviewed·2022-05-01
CVE-2007-4465 [MEDIUM] CWE-79 GHSA-7286-985c-74qv: Cross-site scripting (XSS) vulnerability in mod_autoindex
Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
OSV
CVE-2007-4465: Cross-site scripting (XSS) vulnerability in mod_autoindex
osv·2007-09-14·CVSS 6.1
CVE-2007-4465 [MEDIUM] CVE-2007-4465: Cross-site scripting (XSS) vulnerability in mod_autoindex
Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
Ubuntu
Apache vulnerabilities
vendor_ubuntu·2008-02-04·CVSS 4.3
CVE-2006-3918 [MEDIUM] Apache vulnerabilities
Title: Apache vulnerabilities
Summary: Apache vulnerabilities
It was discovered that Apache did not sanitize the Expect header from
an HTTP request when it is reflected back in an error message, which
could result in browsers becoming vulnerable to cross-site scripting
attacks when processing the output. With cross-site scripting
vulnerabilities, if a user were tricked into viewing server output
during a crafted server request, a remote attacker could exploit this
to modify the contents, or steal confidential data (such as passwords),
within the same domain. This was only vulnerable in Ubuntu 6.06.
(CVE-2006-3918)
It was discovered that when configured as a proxy server and using a
threaded MPM, Apache did not properly sanitize its input. A remote
attacker could send Apache crafted date
Red Hat
mod_autoindex XSS
vendor_redhat·2007-09-13·CVSS 6.1
CVE-2007-4465 [MEDIUM] CWE-79 mod_autoindex XSS
mod_autoindex XSS
Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
Statement: This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the "AddDefaultCharset" directive and are using directory indexes. The Red Hat Product Security has rated this issue as ha
Debian
CVE-2007-4465: apache2 - Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP S...
vendor_debian·2007·CVSS 6.1
CVE-2007-4465 [MEDIUM] CVE-2007-4465: apache2 - Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP S...
Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
Scope: local
bookworm: resolved (fixed in 2.2.6-1)
bullseye: resolved (fixed in 2.2.6-1)
forky: resolved (fixed in 2.2.6-1)
sid: resolved (fixed in 2.2.6-1)
trixie: resolved (fixed in 2.2.6-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2008-2168 httpd: XSS via UTF-7 encoded urls on the 403 Forbidden error page
bugzilla·2008-05-14·CVSS 4.3
CVE-2008-2168 [MEDIUM] CVE-2008-2168 httpd: XSS via UTF-7 encoded urls on the 403 Forbidden error page
CVE-2008-2168 httpd: XSS via UTF-7 encoded urls on the 403 Forbidden error page
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-2168 to the following vulnerability:
Cross-site scripting (XSS) vulnerability Apache 2.2.6 and earlier
allows remote attackers to inject arbitrary web script or HTML via
UTF-7 encoded URLs that are not properly handled when displaying the
403 Forbidden error page.
References:
http://marc.info/?l=bugtraq&m=121034653105913&w=4
http://www.securityfocus.com/archive/1/491862/30/30/threaded
http://www.securityfocus.com/bid/29112
http://xforce.iss.net/xforce/xfdb/42303
Discussion:
See similar issue:
https://bugzilla.redhat.com/show_bug.cgi?id=cve-2007-4465
Bugzilla
CVE-2007-4465 mod_autoindex XSS
bugzilla·2007-09-13·CVSS 6.1
CVE-2007-4465 [MEDIUM] CVE-2007-4465 mod_autoindex XSS
CVE-2007-4465 mod_autoindex XSS
mod_autoindex in httpd contains a cross site scripting flaw via the P query option.
More information can be found in the original vulnerability report here:
http://www.securityfocus.com/archive/1/479237/30/0/threaded
Discussion:
Joe,
Can you comment on this, should this flaw be rated as having low severity?
---
Joe says this should be low, so low it is.
---
According to NVD:
Official Statement from Apache (9/14/2007)
The Apache security team believe that this issue is due to web browsers that are
violating RFC2616.
However, Apache 2.2.6 and 2.0.61 add a workaround for such browsers by adding
Type and Charset options to IndexOptions directive. This allows a site
administrator to explicitly set the content-type and charset of the generated
directory
http://bugs.gentoo.org/show_bug.cgi?id=186219http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432http://lists.apple.com/archives/security-announce/2008//May/msg00001.htmlhttp://marc.info/?l=bugtraq&m=124654546101607&w=2http://marc.info/?l=bugtraq&m=125631037611762&w=2http://secunia.com/advisories/26842http://secunia.com/advisories/26952http://secunia.com/advisories/27563http://secunia.com/advisories/27732http://secunia.com/advisories/28467http://secunia.com/advisories/28471http://secunia.com/advisories/28607http://secunia.com/advisories/28749http://secunia.com/advisories/30430http://secunia.com/advisories/31651http://secunia.com/advisories/33105http://secunia.com/advisories/35650http://security.gentoo.org/glsa/glsa-200711-06.xmlhttp://securityreason.com/achievement_securityalert/46http://securityreason.com/securityalert/3113http://securitytracker.com/id?1019194http://support.avaya.com/elmodocs2/security/ASA-2008-032.htmhttp://www.apache.org/dist/httpd/CHANGES_2.2.6http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:014http://www.novell.com/linux/security/advisories/2007_61_apache2.htmlhttp://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0911.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0004.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0005.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0006.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0008.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0261.htmlhttp://www.securityfocus.com/archive/1/479237/100/0/threadedhttp://www.securityfocus.com/bid/25653http://www.ubuntu.com/usn/usn-575-1http://www.us-cert.gov/cas/techalerts/TA08-150A.htmlhttp://www.vupen.com/english/advisories/2008/1697https://exchange.xforce.ibmcloud.com/vulnerabilities/36586https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10929https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6089https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00353.htmlhttp://bugs.gentoo.org/show_bug.cgi?id=186219http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432http://lists.apple.com/archives/security-announce/2008//May/msg00001.htmlhttp://marc.info/?l=bugtraq&m=124654546101607&w=2http://marc.info/?l=bugtraq&m=125631037611762&w=2http://secunia.com/advisories/26842http://secunia.com/advisories/26952http://secunia.com/advisories/27563http://secunia.com/advisories/27732http://secunia.com/advisories/28467http://secunia.com/advisories/28471http://secunia.com/advisories/28607http://secunia.com/advisories/28749http://secunia.com/advisories/30430http://secunia.com/advisories/31651http://secunia.com/advisories/33105http://secunia.com/advisories/35650http://security.gentoo.org/glsa/glsa-200711-06.xmlhttp://securityreason.com/achievement_securityalert/46http://securityreason.com/securityalert/3113http://securitytracker.com/id?1019194http://support.avaya.com/elmodocs2/security/ASA-2008-032.htmhttp://www.apache.org/dist/httpd/CHANGES_2.2.6http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:014http://www.novell.com/linux/security/advisories/2007_61_apache2.htmlhttp://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0911.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0004.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0005.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0006.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0008.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0261.htmlhttp://www.securityfocus.com/archive/1/479237/100/0/threadedhttp://www.securityfocus.com/bid/25653http://www.ubuntu.com/usn/usn-575-1http://www.us-cert.gov/cas/techalerts/TA08-150A.htmlhttp://www.vupen.com/english/advisories/2008/1697https://exchange.xforce.ibmcloud.com/vulnerabilities/36586https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10929https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6089https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00353.html
2007-09-14
Published