CVE-2006-5752

Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 27 Jun 2007, 17:00
Last modified:07 Aug 2024, 20:04

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
4.3 MEDIUM
v2.0 (nvd)
EPSS Score
18.37% MEDIUM
18% probability +3.49%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Jun 2007, 17:00
Published
Vulnerability first disclosed
07 Aug 2024, 20:04
Last Modified
Vulnerability information updated

Description

Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform "charset detection" when the content-type is not specified.

CVSS Metrics

  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 18.37%• Percentile: 95%

Affected Systems

  • Unknown•HTTP Server

    ≥ 1.3.2, < 1.3.39 | ≥ 2.0.0, < 2.0.61 | ≥ 2.2.0, < 2.2.6

  • canonical•ubuntu_linux

    6.06 | 6.10 | 7.04

  • fedoraproject•fedora

    7

  • redhat•enterprise_linux_desktop

    3.0 | 4.0 | 5.0

  • redhat•enterprise_linux_eus

    4.5

  • redhat•enterprise_linux_server

    3.0 | 4.0 | 5.0

  • redhat•enterprise_linux_workstation

    3.0 | 4.0 | 5.0

References (77)