| Package | Affected versions | Patched versions |
|---|---|---|
| http server | = 2.0.46= 2.0.47= 2.0.48= 2.0.49= 2.0.50= 2.0.51= 2.0.52= 2.0.53= 2.0.54= 2.0.55= 2.0.57= 2.0.58= 2.0.59= 2.1.1= 2.1.2= 2.1.3= 2.1.4= 2.1.5= 2.1.6= 2.1.7= 2.1.8= 2.2.0= 2.2.2= 2.2.3= 2.2.4 |
Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free