CVE-2009-0796: XSS
A flaw was found in the httpd modperl Apache::Status module. If a site has the non default setting of making /perl-status page accessible, remote attackers could use that flaw to trick users or steal sensitive browser data.
The original public announcement can be found here: http://marc.info/?l=apache-modperl&m=123862312808765&w=2
The CVE id mentioned in the above mail is wrong, CVE-2009-0796 is the proper CVE id.
Other sources
Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in modperl1 and modperl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0796?
CVE-2009-0796 is classified as a moderate severity vulnerability impacting the Apache mod_perl module.
How do I fix CVE-2009-0796?
To fix CVE-2009-0796, remove or restrict access to the /perl-status page in your configuration.
Which versions are affected by CVE-2009-0796?
CVE-2009-0796 affects Apache mod_perl versions 1 and 2.
What type of attack is possible with CVE-2009-0796?
CVE-2009-0796 allows remote attackers to trick users or steal sensitive browser data.
Is there a patch available for CVE-2009-0796?
There is no specific patch for CVE-2009-0796, but mitigating the exposure of the vulnerable feature is recommended.