CVE-2002-0840
Summary
| CVE | CVE-2002-0840 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2002-10-11 04:00:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157. |
Risk And Classification
Primary CVSS: v2.0 6.8 from [email protected]
AV:N/AC:M/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Http Server | 1.3 | All | All | All |
| Application | Apache | Http Server | 1.3.1 | All | All | All |
| Application | Apache | Http Server | 1.3.11 | All | All | All |
| Application | Apache | Http Server | 1.3.12 | All | All | All |
| Application | Apache | Http Server | 1.3.14 | All | All | All |
| Application | Apache | Http Server | 1.3.17 | All | All | All |
| Application | Apache | Http Server | 1.3.18 | All | All | All |
| Application | Apache | Http Server | 1.3.19 | All | All | All |
| Application | Apache | Http Server | 1.3.20 | All | All | All |
| Application | Apache | Http Server | 1.3.22 | All | All | All |
| Application | Apache | Http Server | 1.3.23 | All | All | All |
| Application | Apache | Http Server | 1.3.24 | All | All | All |
| Application | Apache | Http Server | 1.3.25 | All | All | All |
| Application | Apache | Http Server | 1.3.26 | All | All | All |
| Application | Apache | Http Server | 1.3.3 | All | All | All |
| Application | Apache | Http Server | 1.3.4 | All | All | All |
| Application | Apache | Http Server | 1.3.6 | All | All | All |
| Application | Apache | Http Server | 1.3.9 | All | All | All |
| Application | Apache | Http Server | 2.0 | All | All | All |
| Application | Apache | Http Server | 2.0.28 | All | All | All |
| Application | Apache | Http Server | 2.0.32 | All | All | All |
| Application | Apache | Http Server | 2.0.35 | All | All | All |
| Application | Apache | Http Server | 2.0.36 | All | All | All |
| Application | Apache | Http Server | 2.0.37 | All | All | All |
| Application | Apache | Http Server | 2.0.38 | All | All | All |
| Application | Apache | Http Server | 2.0.39 | All | All | All |
| Application | Apache | Http Server | 2.0.40 | All | All | All |
| Application | Apache | Http Server | 2.0.41 | All | All | All |
| Application | Apache | Http Server | 2.0.42 | All | All | All |
| Application | Oracle | Application Server | 1.0.2 | All | All | All |
| Application | Oracle | Application Server | 1.0.2.1s | All | All | All |
| Application | Oracle | Application Server | 1.0.2.2 | All | All | All |
| Application | Oracle | Application Server | 9.0.2 | All | All | All |
| Application | Oracle | Application Server | 9.0.2 | r2 | All | All |
| Application | Oracle | Application Server | 9.0.2.1 | All | All | All |
| Application | Oracle | Database Server | 8.1.7 | All | All | All |
| Application | Oracle | Database Server | 9.2.1 | All | All | All |
| Application | Oracle | Database Server | 9.2.2 | All | All | All |
| Application | Oracle | Oracle8i | 8.1.7 | All | All | All |
| Application | Oracle | Oracle8i | 8.1.7.1 | All | All | All |
| Application | Oracle | Oracle8i | 8.1.7_.0.0_enterprise | All | All | All |
| Application | Oracle | Oracle8i | 8.1.7_.1.0_enterprise | All | All | All |
| Application | Oracle | Oracle9i | 9.0 | All | All | All |
| Application | Oracle | Oracle9i | 9.0.1 | All | All | All |
| Application | Oracle | Oracle9i | 9.0.1.2 | All | All | All |
| Application | Oracle | Oracle9i | 9.0.1.3 | All | All | All |
| Application | Oracle | Oracle9i | 9.0.2 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| www.osvdb.org/862 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| archives.neohapsis.com/archives/vulnwatch/2002-q4/0003.html | af854a3a-2127-422b-91ae-364da2661108 | archives.neohapsis.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| www.linux-mandrake.com/en/security/2002/MDKSA-2002-068.php | af854a3a-2127-422b-91ae-364da2661108 | www.linux-mandrake.com | |
| Debian -- Security Information -- DSA-195-1 apache-perl | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| '[Security Release] Apache HTTP Server 2.0.43' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Home - Conectiva | af854a3a-2127-422b-91ae-364da2661108 | distro.conectiva.com.br | |
| redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| LinuxSecurity.com: EnGarde: apache vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.linuxsecurity.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| CERT/CC Vulnerability Note VU#240329 | af854a3a-2127-422b-91ae-364da2661108 | www.kb.cert.org | US Government Resource |
| 'Apache 2 Cross-Site Scripting' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| www.apacheweek.com/issues/02-10-04 | af854a3a-2127-422b-91ae-364da2661108 | www.apacheweek.com | Vendor Advisory |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| '[OpenPKG-SA-2002.009] OpenPKG Security Advisory (apache)' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| SecurityFocus HOME Advisories: Sec. Vulnerability in Apache | af854a3a-2127-422b-91ae-364da2661108 | online.securityfocus.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Debian -- Security Information -- DSA-187-1 apache | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Neohapsis Archives - Bugtraq - TSLSA-2002-0069-apache - From tsl_at_trustix.com | af854a3a-2127-422b-91ae-364da2661108 | archives.neohapsis.com | |
| Apache Server Side Include Cross Site Scripting Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Debian -- Security Information -- DSA-188-1 apache-ssl | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| patches.sgi.com/support/free/security/advisories/20021105-02-I | af854a3a-2127-422b-91ae-364da2661108 | patches.sgi.com | |
| redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Apache | 2008-07-02 | Mark J Cox | Fixed in Apache HTTP Server 2.0.43 and 1.3.27: http://httpd.apache.org/security/vulnerabilities_20.html http://httpd.apache.org/security/vulnerabilities_13.html |
There are currently no legacy QID mappings associated with this CVE.