Vulnerability Details : CVE-2002-1157
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2002-1157
Probability of exploitation activity in the next 30 days: 3.20%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 90 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2002-1157
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
References for CVE-2002-1157
-
http://www.securityfocus.com/bid/6029
- http://www.redhat.com/support/errata/RHSA-2002-251.html
-
http://www.iss.net/security_center/static/10457.php
Vendor Advisory
-
http://online.securityfocus.com/archive/1/296753
-
http://www.redhat.com/support/errata/RHSA-2002-244.html
Support
-
http://www.redhat.com/support/errata/RHSA-2003-106.html
Support
-
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000541
-
http://www.linuxsecurity.com/advisories/other_advisory-2512.html
-
http://www.redhat.com/support/errata/RHSA-2002-248.html
Support
-
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-072.php
-
http://archives.neohapsis.com/archives/bugtraq/2002-10/0374.html
-
http://www.redhat.com/support/errata/RHSA-2002-243.html
Support
-
http://www.debian.org/security/2002/dsa-181
Patch;Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2002-222.html
Products affected by CVE-2002-1157
- cpe:2.3:a:mod_ssl:mod_ssl:*:*:*:*:*:*:*:*