CVE-2012-0216: XSS
First published: Sun Apr 22 2012(Updated: )
The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct cross-site scripting (XSS) attacks, gain privileges, or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server.
Credit: security@debian.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache HTTP Server | <=2.2.16-6 | |
| Apache HTTP Server | <=2.2.22-1 | |
| Apache HTTP Server | <=2.22-3 | |
| Apache HTTP Server | <=2.2.22-3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2012-0216?
CVE-2012-0216 has been classified as a medium-severity vulnerability.
How do I fix CVE-2012-0216?
To fix CVE-2012-0216, upgrade the apache2 package to versions 2.2.16-6+squeeze7 or 2.2.22-4 for Wheezy.
Who is affected by CVE-2012-0216?
CVE-2012-0216 affects Debian GNU/Linux users running specific versions of the apache2 package with mod_php or mod_rivet enabled.
What are the implications of CVE-2012-0216?
CVE-2012-0216 may allow local users to conduct cross-site scripting (XSS) attacks due to the presence of example scripts.
Is CVE-2012-0216 still an active threat?
CVE-2012-0216 is considered less of an active threat now due to the availability of fixed versions of the affected software.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/debian
- canonical/apache http server
- version/apache http server/2.2.16-6
- version/apache http server/2.2.22-1
- version/apache http server/2.22-3
- version/apache http server/2.2.22-3