CVE-2006-5752

Description

Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform "charset detection" when the content-type is not specified.

4.3

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 15.79% Top 10%

Vendor Advisory mandriva.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory ibm.com Vendor Advisory mandriva.com Vendor Advisory sun.com Vendor Advisory redhat.com Vendor Advisory novell.com Vendor Advisory redhat.com Vendor Advisory trustix.org Vendor Advisory mandriva.com Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory ibm.com Vendor Advisory sun.com Vendor Advisory hp.com Vendor Advisory ubuntu.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory apache.org Vendor Advisory apache.org Vendor Advisory apache.org Vendor Advisory apache.org

Affected: n/a n/a

References

Link	Tags
http://secunia.com/advisories/28606	third party advisory not applicable
http://secunia.com/advisories/26458	third party advisory not applicable
http://www.mandriva.com/security/advisories?name=MDKSA-2007:142	vendor advisory broken link
https://rhn.redhat.com/errata/RHSA-2007-0533.html	third party advisory vendor advisory
http://secunia.com/advisories/26822	third party advisory not applicable
https://exchange.xforce.ibmcloud.com/vulnerabilities/35097	vdb entry third party advisory
http://www.vupen.com/english/advisories/2007/4305	vdb entry permissions required
http://www.redhat.com/support/errata/RHSA-2007-0557.html	third party advisory vendor advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702	third party advisory vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:140	vendor advisory broken link
http://secunia.com/advisories/25827	third party advisory not applicable
http://secunia.com/advisories/25920	third party advisory not applicable
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10154	vdb entry third party advisory signature
http://secunia.com/advisories/26993	third party advisory not applicable
http://secunia.com/advisories/28212	third party advisory not applicable
http://secunia.com/advisories/27563	third party advisory not applicable
http://secunia.com/advisories/27732	third party advisory not applicable
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1	vendor advisory broken link
http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html	third party advisory
http://rhn.redhat.com/errata/RHSA-2007-0556.html	third party advisory vendor advisory
http://httpd.apache.org/security/vulnerabilities_20.html	vendor advisory
http://www.securityfocus.com/bid/24645	vdb entry third party advisory patch
http://www.novell.com/linux/security/advisories/2007_61_apache2.html	vendor advisory broken link
http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html	mailing list third party advisory vendor advisory
http://www.trustix.org/errata/2007/0026/	vendor advisory broken link
http://httpd.apache.org/security/vulnerabilities_22.html	vendor advisory
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245112	issue tracking third party advisory
http://www.vupen.com/english/advisories/2007/3386	vdb entry permissions required
http://www.securitytracker.com/id?1018302	vdb entry third party advisory broken link
http://www.securityfocus.com/archive/1/505990/100/0/threaded	mailing list vdb entry third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:141	vendor advisory broken link
http://www.vupen.com/english/advisories/2008/0233	vdb entry permissions required
http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html	third party advisory
http://secunia.com/advisories/27037	third party advisory not applicable
http://secunia.com/advisories/26443	third party advisory not applicable
http://lists.vmware.com/pipermail/security-announce/2009/000062.html	third party advisory mailing list
http://httpd.apache.org/security/vulnerabilities_13.html	vendor advisory
http://svn.apache.org/viewvc?view=rev&revision=549159	vendor advisory
http://security.gentoo.org/glsa/glsa-200711-06.xml	third party advisory vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-0532.html	third party advisory vendor advisory
https://issues.rpath.com/browse/RPL-1500	broken link
http://www-1.ibm.com/support/search.wss?rs=0&q=PK49295&apar=only	third party advisory vendor advisory
http://secunia.com/advisories/28224	third party advisory not applicable
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1	vendor advisory broken link
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795	third party advisory vendor advisory
http://osvdb.org/37052	vdb entry broken link
http://secunia.com/advisories/25830	third party advisory not applicable
http://www.ubuntu.com/usn/usn-499-1	third party advisory vendor advisory
http://www.redhat.com/support/errata/RHSA-2008-0261.html	third party advisory vendor advisory
http://secunia.com/advisories/26508	third party advisory not applicable
http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm	third party advisory
http://secunia.com/advisories/26842	third party advisory not applicable
http://www.vupen.com/english/advisories/2007/3283	vdb entry permissions required
http://www.vupen.com/english/advisories/2007/2727	vdb entry permissions required
http://rhn.redhat.com/errata/RHSA-2007-0534.html	third party advisory vendor advisory
http://secunia.com/advisories/26273	third party advisory not applicable
http://secunia.com/advisories/25873	third party advisory not applicable
http://bugs.gentoo.org/show_bug.cgi?id=186219	issue tracking third party advisory
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E	mailing list

Frequently Asked Questions

What is the severity of CVE-2006-5752?: CVE-2006-5752 has been scored as a medium severity vulnerability.
How to fix CVE-2006-5752?: To fix CVE-2006-5752, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-5752 being actively exploited in the wild?: It is possible that CVE-2006-5752 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~16% probability that this vulnerability will be exploited by malicious actors in the next 30 days.