Evil-DB LogoEvil-DB
← All CVEs

CVE-2007-6203

medium · 4.3

Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.

4.3
CVSS
80.7%
EPSS (exploit prob.)
100th
EPSS percentile
2007-12-03
Published

AV:N/AC:M/Au:N/C:N/I:P/A:N

Weaknesses

CWE-79

Affected products

VendorProductAffected versions
apachehttp_server2.0.46
apachehttp_server2.0.47
apachehttp_server2.0.48
apachehttp_server2.0.49
apachehttp_server2.0.50
apachehttp_server2.0.51
apachehttp_server2.0.52
apachehttp_server2.0.53
apachehttp_server2.0.54
apachehttp_server2.0.55
apachehttp_server2.0.57
apachehttp_server2.0.58
apachehttp_server2.0.59
apachehttp_server2.1.1
apachehttp_server2.1.2
apachehttp_server2.1.3
apachehttp_server2.1.4
apachehttp_server2.1.5
apachehttp_server2.1.6
apachehttp_server2.1.7
apachehttp_server2.1.8
apachehttp_server2.2.0
apachehttp_server2.2.2
apachehttp_server2.2.3
apachehttp_server2.2.4

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2007-6203