CVE-2007-6421
published 2008-01-08CVE-2007-6421: Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to…
PriorityP417low3.5CVSS 2.0
AVNACMAuSCNIPAN
EPSS
8.32%
94.3th percentile
Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| debian | apache2 | < apache2 2.2.8-1 (bookworm) | apache2 2.2.8-1 (bookworm) |
CVSS provenance
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv3.5LOW
vendor_ubuntu4.3MEDIUM
vendor_debian3.5LOW
vendor_redhat3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Apache vulnerabilities
vendor_ubuntu·2008-02-04·CVSS 4.3
CVE-2006-3918 [MEDIUM] Apache vulnerabilities
Title: Apache vulnerabilities
Summary: Apache vulnerabilities
It was discovered that Apache did not sanitize the Expect header from
an HTTP request when it is reflected back in an error message, which
could result in browsers becoming vulnerable to cross-site scripting
attacks when processing the output. With cross-site scripting
vulnerabilities, if a user were tricked into viewing server output
during a crafted server request, a remote attacker could exploit this
to modify the contents, or steal confidential data (such as passwords),
within the same domain. This was only vulnerable in Ubuntu 6.06.
(CVE-2006-3918)
It was discovered that when configured as a proxy server and using a
threaded MPM, Apache did not properly sanitize its input. A remote
attacker could send Apache crafted date
Red Hat
httpd mod_proxy_balancer cross-site scripting
vendor_redhat·2008-01-02·CVSS 3.5
CVE-2007-6421 [LOW] CWE-79 httpd mod_proxy_balancer cross-site scripting
httpd mod_proxy_balancer cross-site scripting
Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
Debian
CVE-2007-6421: apache2 - Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balanc...
vendor_debian·2007·CVSS 3.5
CVE-2007-6421 [LOW] CVE-2007-6421: apache2 - Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balanc...
Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
Scope: local
bookworm: resolved (fixed in 2.2.8-1)
bullseye: resolved (fixed in 2.2.8-1)
forky: resolved (fixed in 2.2.8-1)
sid: resolved (fixed in 2.2.8-1)
trixie: resolved (fixed in 2.2.8-1)
GHSA
GHSA-g65v-mwjw-wg6c: Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2
ghsa_unreviewed·2022-05-01
CVE-2007-6421 [LOW] CWE-79 GHSA-g65v-mwjw-wg6c: Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2
Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
OSV
CVE-2007-6421: Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2
osv·2008-01-08·CVSS 3.5
CVE-2007-6421 [LOW] CVE-2007-6421: Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2
Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
No detection rules found.
Exploit-DB
Microsoft SharePoint Server 2007 - Cross-Site Scripting
exploitdb·2010-04-29
CVE-2010-0817 Microsoft SharePoint Server 2007 - Cross-Site Scripting
Microsoft SharePoint Server 2007 - Cross-Site Scripting
---
Vulnerability ID: HTB22350
Reference:
http://www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html
http://www.microsoft.com/technet/security/advisory/983438.mspx
Product: Microsoft SharePoint Server 2007
Vendor: Microsoft Corporation
Vulnerable Version: 12.0.0.6421 and Probably Prior Versions Vendor
Notification: 12 April 2010 Vulnerability Type: XSS (Сross Site Sсriрting)
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response Risk level:
Medium
Credit: High-Tech Bridge SA (http://www.htbridge.ch/)
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable
application.
The vulnerability exists due to failure in the "/_layouts/help.aspx" script
to properly sanitize user-s
Exploit-DB
Social Site Generator 2.0 - 'path' Remote File Inclusion
exploitdb·2008-05-31
CVE-2008-6421 Social Site Generator 2.0 - 'path' Remote File Inclusion
Social Site Generator 2.0 - 'path' Remote File Inclusion
---
############################################################################################
#
# Application Name : Social Site Generator
#
# Download : http://rapidshare.com/files/118424866/Social.Site.Generator.v2._iAG_.Nulled.rar
#
# Vulnerable Type : RFI (remote file include)
#
# Dork : search it :p
#
# Vulnerable file : social_game_play.php
#
# author : vBmad
#
# Team : nab3 Team & hamama team
#
# Greatz : ALLAH
# rouchtekh & jonelo & okx all hackerz moroccan & bigg thnx to my teacher Roi-PhP
# www.nab3i.com & www.nab3.2007.fr & www.maroc-mp3.net
#
#
############################################################################################
|
\ / |
\ / [email protected] |
\/__________________________________|
Exploit :
No writeups or analysis indexed.
http://docs.info.apple.com/article.html?artnum=307562http://httpd.apache.org/security/vulnerabilities_22.htmlhttp://lists.apple.com/archives/security-announce/2008/Mar/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.htmlhttp://secunia.com/advisories/28526http://secunia.com/advisories/28749http://secunia.com/advisories/28977http://secunia.com/advisories/29420http://secunia.com/advisories/29640http://securityreason.com/securityalert/3523http://www.mandriva.com/security/advisories?name=MDVSA-2008:016http://www.redhat.com/support/errata/RHSA-2008-0008.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0009.htmlhttp://www.securityfocus.com/archive/1/486169/100/0/threadedhttp://www.securityfocus.com/bid/27236http://www.ubuntu.com/usn/usn-575-1http://www.vupen.com/english/advisories/2008/0048http://www.vupen.com/english/advisories/2008/0924/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/39474https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10664https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8651https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.htmlhttp://docs.info.apple.com/article.html?artnum=307562http://httpd.apache.org/security/vulnerabilities_22.htmlhttp://lists.apple.com/archives/security-announce/2008/Mar/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.htmlhttp://secunia.com/advisories/28526http://secunia.com/advisories/28749http://secunia.com/advisories/28977http://secunia.com/advisories/29420http://secunia.com/advisories/29640http://securityreason.com/securityalert/3523http://www.mandriva.com/security/advisories?name=MDVSA-2008:016http://www.redhat.com/support/errata/RHSA-2008-0008.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0009.htmlhttp://www.securityfocus.com/archive/1/486169/100/0/threadedhttp://www.securityfocus.com/bid/27236http://www.ubuntu.com/usn/usn-575-1http://www.vupen.com/english/advisories/2008/0048http://www.vupen.com/english/advisories/2008/0924/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/39474https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10664https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8651https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html
2008-01-08
Published