CVE-2003-1581: apache http_server Cross-site Scripting

Vulnerability summary

CVE-2003-1581 is a low (CVSS 2.6) Cross-site Scripting vulnerability in apache http_server. EPSS estimates a 3.08% chance of exploitation in the next 30 days, higher than 87.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-02-2010
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.