Lucene search

K
cveMitreCVE-2007-4465
HistorySep 14, 2007 - 12:17 a.m.

CVE-2007-4465

2007-09-1400:17:00
CWE-79
mitre
web.nvd.nist.gov
158
cve-2007-4465
cross-site scripting
xss
apache http server
mod_autoindex.c
web security
vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.4

Confidence

High

EPSS

0.015

Percentile

87.3%

Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.

Affected configurations

Nvd
Node
apachehttp_serverRange2.0.02.0.61
OR
apachehttp_serverRange2.2.02.2.6
VendorProductVersionCPE
apachehttp_server*cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.4

Confidence

High

EPSS

0.015

Percentile

87.3%