Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2007-6203

Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.

Published

2007-12-03T22:46:00.000

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	apache	http_server	2.0.46	Yes
Application	apache	http_server	2.0.47	Yes
Application	apache	http_server	2.0.48	Yes
Application	apache	http_server	2.0.49	Yes
Application	apache	http_server	2.0.50	Yes
Application	apache	http_server	2.0.51	Yes
Application	apache	http_server	2.0.52	Yes
Application	apache	http_server	2.0.53	Yes
Application	apache	http_server	2.0.54	Yes
Application	apache	http_server	2.0.55	Yes
Application	apache	http_server	2.0.57	Yes
Application	apache	http_server	2.0.58	Yes
Application	apache	http_server	2.0.59	Yes
Application	apache	http_server	2.1.1	Yes
Application	apache	http_server	2.1.2	Yes
Application	apache	http_server	2.1.3	Yes
Application	apache	http_server	2.1.4	Yes
Application	apache	http_server	2.1.5	Yes
Application	apache	http_server	2.1.6	Yes
Application	apache	http_server	2.1.7	Yes
Application	apache	http_server	2.1.8	Yes
Application	apache	http_server	2.2.0	Yes
Application	apache	http_server	2.2.2	Yes
Application	apache	http_server	2.2.3	Yes
Application	apache	http_server	2.2.4	Yes

References

http://docs.info.apple.com/article.html?artnum=307562 ([email protected])
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html ([email protected])
http://marc.info/?l=bugtraq&m=125631037611762&w=2 ([email protected])
http://marc.info/?l=bugtraq&m=129190899612998&w=2 ([email protected])
http://procheckup.com/Vulnerability_PR07-37.php Exploit ([email protected])
http://secunia.com/advisories/27906 Vendor Advisory ([email protected])
http://secunia.com/advisories/28196 Vendor Advisory ([email protected])
http://secunia.com/advisories/29348 Vendor Advisory ([email protected])
http://secunia.com/advisories/29420 Vendor Advisory ([email protected])
http://secunia.com/advisories/29640 Vendor Advisory ([email protected])
http://secunia.com/advisories/30356 Vendor Advisory ([email protected])
http://secunia.com/advisories/30732 Vendor Advisory ([email protected])
http://secunia.com/advisories/33105 Vendor Advisory ([email protected])
http://secunia.com/advisories/34219 Vendor Advisory ([email protected])
http://security.gentoo.org/glsa/glsa-200803-19.xml ([email protected])
http://securityreason.com/securityalert/3411 ([email protected])
http://www-1.ibm.com/support/docview.wss?uid=swg1PK57952 ([email protected])
http://www-1.ibm.com/support/docview.wss?uid=swg24019245 ([email protected])
http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.html ([email protected])
http://www.securityfocus.com/archive/1/484410/100/0/threaded ([email protected])
http://www.securityfocus.com/bid/26663 Exploit ([email protected])
http://www.securitytracker.com/id?1019030 ([email protected])
http://www.ubuntu.com/usn/USN-731-1 ([email protected])
http://www.vupen.com/english/advisories/2007/4060 ([email protected])
http://www.vupen.com/english/advisories/2007/4301 ([email protected])
http://www.vupen.com/english/advisories/2008/0924/references ([email protected])
http://www.vupen.com/english/advisories/2008/1623/references ([email protected])
http://www.vupen.com/english/advisories/2008/1875/references ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/38800 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12166 ([email protected])
http://docs.info.apple.com/article.html?artnum=307562 (af854a3a-2127-422b-91ae-364da2661108)
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html (af854a3a-2127-422b-91ae-364da2661108)
http://marc.info/?l=bugtraq&m=125631037611762&w=2 (af854a3a-2127-422b-91ae-364da2661108)
http://marc.info/?l=bugtraq&m=129190899612998&w=2 (af854a3a-2127-422b-91ae-364da2661108)
http://procheckup.com/Vulnerability_PR07-37.php Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/27906 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/28196 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/29348 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/29420 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/29640 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/30356 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/30732 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/33105 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34219 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-200803-19.xml (af854a3a-2127-422b-91ae-364da2661108)
http://securityreason.com/securityalert/3411 (af854a3a-2127-422b-91ae-364da2661108)
http://www-1.ibm.com/support/docview.wss?uid=swg1PK57952 (af854a3a-2127-422b-91ae-364da2661108)
http://www-1.ibm.com/support/docview.wss?uid=swg24019245 (af854a3a-2127-422b-91ae-364da2661108)
http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/484410/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/26663 Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id?1019030 (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/USN-731-1 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2007/4060 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2007/4301 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2008/0924/references (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2008/1623/references (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2008/1875/references (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/38800 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12166 (af854a3a-2127-422b-91ae-364da2661108)