CVE-2002-0840: Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS…

Unscored severity · published Oct 11, 2002

CVE-2002-0840

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS…

–

CVSS

95.1%

EPSS

On KEV

Description

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.

Exploitation

Is it being used?

Exploit prediction (EPSS)95.1% · higher than 100% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

HTTP Server · Apache

1.3; 1.3.1; 1.3.3; 1.3.4; 1.3.6; 1.3.9; +23 more · source: NVD

Application Server · Oracle

1.0.2; 1.0.2.1s; 1.0.2.2; 9.0.2; 9.0.2; 9.0.2.1 · source: NVD