CVE-2009-0796
Published Apr 7, 2009
Last updated 2 years ago
Overview
- Description
- Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.
- Source
- secalert@redhat.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 2.6
- Impact score
- 2.9
- Exploitability score
- 4.9
- Vector string
- AV:N/AC:H/Au:N/C:N/I:P/A:N
Weaknesses
- nvd@nist.gov
- CWE-79
Vendor comments
- Red HatRed Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2009-0796 The Red Hat Security Response Team has rated this issue as having moderate security impact, a future mod_perl package update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:mod_perl:1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D7612B6F-0CBF-4866-8293-37EF407C7BD0"
},
{
"criteria": "cpe:2.3:a:apache:mod_perl:2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8639339-6C55-43A0-BCF1-56C75A6CA19B"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5A6CD1F4-4C0E-4989-A2B3-DC086E8E80A3"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
]