NVD

Id
56590  
Name
CVE-2007-4465  
Description
Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2007-09-13  
Modified Date
2011-03-07  
Seq
2007-4465  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
288332 56590 CVE-2007-4465 http://bugs.gentoo.org/show_bug.cgi?id=186219  View
288333 56590 CVE-2007-4465 SSRT080118  View
288334 56590 CVE-2007-4465 APPLE-SA-2008-05-28  View
288335 56590 CVE-2007-4465 HPSBUX02431  View
288336 56590 CVE-2007-4465 HPSBUX02465  View
288337 56590 CVE-2007-4465 oval:org.mitre.oval:def:10929  View
288338 56590 CVE-2007-4465 oval:org.mitre.oval:def:6089  View
288339 56590 CVE-2007-4465 GLSA-200711-06  View
288340 56590 CVE-2007-4465 20070912 Apache2 Undefined Charset UTF-7 XSS Vulnerability  View
288341 56590 CVE-2007-4465 3113  View
288342 56590 CVE-2007-4465 1019194  View
288343 56590 CVE-2007-4465 http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm  View
288344 56590 CVE-2007-4465 http://www.apache.org/dist/httpd/CHANGES_2.2.6  View
288345 56590 CVE-2007-4465 http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.html  View
288346 56590 CVE-2007-4465 MDVSA-2008:014  View
288347 56590 CVE-2007-4465 SUSE-SA:2007:061  View
288348 56590 CVE-2007-4465 FEDORA-2007-2214  View
288349 56590 CVE-2007-4465 RHSA-2007:0911  View
288350 56590 CVE-2007-4465 RHSA-2008:0004  View
288351 56590 CVE-2007-4465 RHSA-2008:0005  View
288352 56590 CVE-2007-4465 RHSA-2008:0006  View
288353 56590 CVE-2007-4465 RHSA-2008:0008  View
288354 56590 CVE-2007-4465 RHSA-2008:0261  View
288355 56590 CVE-2007-4465 20070912 Apache2 Undefined Charset UTF-7 XSS Vulnerability  View
288356 56590 CVE-2007-4465 25653  View
288357 56590 CVE-2007-4465 USN-575-1  View
288358 56590 CVE-2007-4465 TA08-150A  View
288359 56590 CVE-2007-4465 ADV-2008-1697  View
288360 56590 CVE-2007-4465 apache-utf7-xss(36586)  View
288361 56590 CVE-2007-4465 FEDORA-2007-707  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
52332 JVNDB-2007-001022 Apache の mod_autoindex.c における UTF-7 エンコードに関するクロスサイトスクリプティングの脆弱性 Apache HTTP Server の mod_autoindex.c には、サーバが生成するページで charset が定義されていないため、P 変数の UTF-7 エンコードを用いたクロスサイトスクリプティングの脆弱性が存在します。 CVE-2007-4465 27820 CVE-2007-4465 56590 4.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001022.html 2007-12-07 2009-11-16 View