CVE-2007-6421

LOW 3.5CVE-2007-6421 · Published 08/01/2008 · updated 16/06/2026

In short

CVE-2007-6421 is a LOW (CVSS 3.5) vulnerability affecting http server (apache).
Chance of exploitation in the next 30 days (EPSS): 8.3%, higher than 94.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
http server apache	`= 2.2= 2.2.1= 2.2.2= 2.2.3= 2.2.4= 2.2.6`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.

References

docs.info.apple.com/article.html
httpd.apache.org/security/vulnerabilities_22.html
lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html
secunia.com/advisories/28526
secunia.com/advisories/28749
secunia.com/advisories/28977
secunia.com/advisories/29420
secunia.com/advisories/29640
securityreason.com/securityalert/3523
mandriva.com/security/advisories
redhat.com/support/errata/RHSA-2008-0008.html
redhat.com/support/errata/RHSA-2008-0009.html
securityfocus.com/archive/1/486169/100/0/threaded

More vulnerabilities in http server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free