Unscored severity · published Dec 31, 2004
CVE-2004-2171
Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the…
–
CVSS
3.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting error page.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Cherokee Httpd · Cherokee
0.1; 0.1.5; 0.1.6; 0.2; 0.2.5; 0.2.6; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2171
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2171
Exploit
http://secunia.com/advisories/10701/
Patch
http://www.osvdb.org/3707
Exploit
http://www.securityfocus.com/bid/9496
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/14936
More from Cherokee Httpd
–
CVE-2009-3902
Directory traversal vulnerability in Cherokee Web Server 0.5.4 and earlier for Windows allows remote attackers to read arbitrary files via a /\
–
CVE-2006-1681
Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an…
–
CVE-2004-1097
Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when authenticating via auth_pam, allows remote attackers to cause a…
–
CVE-2004-1946
Format string vulnerability in the PRINT_ERROR function in common.c for Cherokee Web Server 0.4.16 and earlier allows local users to execute arbitrary code via format string…
–
CVE-2003-1198
connection.c in Cherokee web server before 0.4.6 allows remote attackers to cause a denial of service via an HTTP POST request without a Content-Length header field