Detections
Analytics
Apache < 2.2.8 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 4385
Synopsis
The remote web server may be affected by several issues.Description
The version of Apache installed on the remote host is advertising a version older than 2.2.8. Such versions may be affected by several issues, including :- A cross-site scripting issue involving mod_imagemap (CVE-2007-5000).
- A cross-site scripting issue involving 413 error pages via a malformed HTTP method (PR 44014 / CVE-2007-6203).
- A cross-site scripting issue in mod_status involving the refresh parameter (CVE-2007-6388).
- A cross-site scripting issue in mod_proxy_balancer involving the worker route and worker redirect string of the balancer manager (CVE-2007-6421).
- A denial of service issue in the balancer_handler function in mod_proxy_balancer can be triggered by an authenticated user when a threaded Multi-Processing Module is used (CVE-2007-6422).
- A cross-site scripting issue using UTF-7 encoding in mod_proxy_ftp exists because it does not define a charset (CVE-2008-0005).
Solution
Upgrade to version 2.2.8 or higher.See Also
https://archive.apache.org/dist/httpd/CHANGES_2.2
Plugin Details
Severity: High
ID: 4385
Family: Web Servers
Published: 2/20/2008
Updated: 3/6/2019
Nessus ID: 31118
Risk Information
VPR
Risk Factor: Medium
Score: 4.2
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:apache:http_server:2.0
Reference Information
CVE: CVE-2007-5000, CVE-2007-6203, CVE-2007-6388, CVE-2007-6420, CVE-2007-6421, CVE-2007-6422, CVE-2007-6423, CVE-2008-0005