CVE-2007-4465: XSS
Cross-site scripting (XSS) vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-4465?
CVE-2007-4465 is classified as a moderate severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2007-4465?
To fix CVE-2007-4465, upgrade to Apache HTTP Server version 2.2.6 or later.
Which versions of Apache HTTP Server are affected by CVE-2007-4465?
CVE-2007-4465 affects various versions of Apache HTTP Server prior to 2.2.6, including all 2.0.x and many 2.2.x versions.
What type of attack does CVE-2007-4465 enable?
CVE-2007-4465 enables remote attackers to perform cross-site scripting (XSS) attacks via the P parameter using the UTF-7 charset.
Is CVE-2007-4465 a commonly exploited vulnerability?
While CVE-2007-4465 can be exploited for XSS attacks, its actual exploitation in the wild may vary and depend on specific circumstances.