Unscored severity · published Nov 4, 2002
CVE-2002-1157
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute…
–
CVSS
11.1%
EPSS
No
On KEV
Description
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
Exploitation
Is it being used?
Exploit prediction (EPSS)11.1% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Mod Ssl · Mod Ssl
through 2.8.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1157
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1157
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2002-10/0374.html
distro.conectiva.com.br
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000541
online.securityfocus.com
http://online.securityfocus.com/archive/1/296753
Patch
http://www.debian.org/security/2002/dsa-181
Vendor Advisory
http://www.iss.net/security_center/static/10457.php
www.linux-mandrake.com
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-072.php
More from Mod Ssl
–
CVE-2004-0700
Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute…
–
CVE-2002-0082
The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which…