CVE-2006-1681: XSS

Published Apr 10, 2006

Updated

Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated.

Affected Software

13 affected components

Cherokee Cherokee HTTPD=0.4.6

Cherokee Cherokee HTTPD=0.5

Cherokee Cherokee HTTPD=0.2

Cherokee Cherokee HTTPD=0.4.9

Cherokee Cherokee HTTPD=0.1.6

Cherokee Cherokee HTTPD=0.2.6

Cherokee Cherokee HTTPD=0.2.5

Cherokee Cherokee HTTPD=0.4.17

Cherokee Cherokee HTTPD=0.1

Cherokee Cherokee HTTPD=0.4.8

Cherokee Cherokee HTTPD=0.2.7

Cherokee Cherokee HTTPD=0.4.7

Cherokee Cherokee HTTPD=0.1.5

Remediation

Patch Available

http://secunia.com/advisories/19587

Event History

Apr 11, 2006

CVE Published

12:02 AM

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-1681?

The severity of CVE-2006-1681 is considered moderate due to its potential for cross-site scripting attacks.

How do I fix CVE-2006-1681?

To fix CVE-2006-1681, you should upgrade to a patched version of Cherokee HTTPD that addresses the XSS vulnerability.

Which versions of Cherokee HTTPD are affected by CVE-2006-1681?

CVE-2006-1681 affects Cherokee HTTPD versions 0.5 and earlier.

Can CVE-2006-1681 be exploited remotely?

Yes, CVE-2006-1681 can be exploited remotely by sending a malformed request to the Cherokee HTTPD.

What types of attacks can CVE-2006-1681 facilitate?

CVE-2006-1681 can facilitate cross-site scripting attacks, allowing attackers to inject arbitrary scripts into web pages viewed by users.