CVE-2012-2687

2012-08-2200:00:00

ubuntu.com

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

0.007 Low

EPSS

Percentile

79.7%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the
make_variant_list function in mod_negotiation.c in the mod_negotiation
module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews
option is enabled, allow remote attackers to inject arbitrary web script or
HTML via a crafted filename that is not properly handled during
construction of a variant list.

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchapache2< 2.2.8-1ubuntu0.24UNKNOWN
ubuntu10.04noarchapache2< 2.2.14-5ubuntu8.10UNKNOWN
ubuntu11.10noarchapache2< 2.2.20-1ubuntu1.3UNKNOWN
ubuntu12.04noarchapache2< 2.2.22-1ubuntu1.2UNKNOWN
ubuntu12.10noarchapache2< 2.2.22-6ubuntu2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	apache2	< 2.2.8-1ubuntu0.24	UNKNOWN
ubuntu	10.04	noarch	apache2	< 2.2.14-5ubuntu8.10	UNKNOWN
ubuntu	11.10	noarch	apache2	< 2.2.20-1ubuntu1.3	UNKNOWN
ubuntu	12.04	noarch	apache2	< 2.2.22-1ubuntu1.2	UNKNOWN
ubuntu	12.10	noarch	apache2	< 2.2.22-6ubuntu2.1	UNKNOWN