CVE-2002-1157 - Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonical

CVE-2002-1157

Summary

Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.

References

Vulnerable Configurations

cpe:2.3:a:mod_ssl:mod_ssl:*:*:*:*:*:*:*:*
cpe:2.3:a:mod_ssl:mod_ssl:*:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 05-09-2008 - 20:29)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

redhat via4

advisories

rhsa
id RHSA-2002:222
rhsa
id RHSA-2002:243
rhsa
id RHSA-2002:244
rhsa
id RHSA-2002:248
rhsa
id RHSA-2002:251
rhsa
id RHSA-2003:106

refmap via4

bid	6029
bugtraq	20021023 [OpenPKG-SA-2002.010] OpenPKG Security Advisory (apache) 20021026 GLSA: mod_ssl
conectiva	CLA-2002:541
debian	DSA-181
engarde	ESA-20021029-027
mandrake	MDKSA-2002:072
osvdb	2107
xf	apache-modssl-host-xss(10457)

Last major update

05-09-2008 - 20:29

Published

04-11-2002 - 05:00

Last modified

05-09-2008 - 20:29