CVE-2012-2687: XSS
Multiple cross-site scripting (XSS) vulnerabilities in the makevariantlist function in modnegotiation.c in the modnegotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.
Affected Software
Event History
Frequently Asked Questions
What versions of Apache HTTP Server are affected by CVE-2012-2687?
CVE-2012-2687 affects Apache HTTP Server versions 2.4.x before 2.4.3 and multiple versions in the 2.2.x series.
What is CVE-2012-2687?
CVE-2012-2687 is a vulnerability that allows remote attackers to inject arbitrary web scripts or HTML due to multiple cross-site scripting (XSS) vulnerabilities in the mod_negotiation module.
Is CVE-2012-2687 a high severity vulnerability?
Yes, CVE-2012-2687 is considered a significant security risk due to its potential for cross-site scripting attacks.
How do I fix CVE-2012-2687?
To resolve CVE-2012-2687, you should upgrade your Apache HTTP Server to version 2.4.3 or later, or to a secure 2.2.x version.
What specific functionality in Apache is exploited by CVE-2012-2687?
CVE-2012-2687 targets the make_variant_list function in the mod_negotiation module when the MultiViews option is enabled.