CVE-2012-2687

low
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.

References

http://httpd.apache.org/security/vulnerabilities_24.html

http://www.apache.org/dist/httpd/CHANGES_2.4.3

http://mail-archives.apache.org/mod_mbox/www-announce/201208.mbox/%[email protected]%3E

http://www.ubuntu.com/usn/USN-1627-1

http://rhn.redhat.com/errata/RHSA-2012-1592.html

http://rhn.redhat.com/errata/RHSA-2012-1591.html

http://secunia.com/advisories/51607

http://rhn.redhat.com/errata/RHSA-2012-1594.html

http://lists.opensuse.org/opensuse-updates/2013-02/msg00011.html

http://rhn.redhat.com/errata/RHSA-2013-0130.html

http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html

http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html

http://www.securityfocus.com/bid/55131

http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf

http://www-01.ibm.com/support/docview.wss?uid=nas2a2b50a0ca011b37c86257a96003c9a4f

http://secunia.com/advisories/50894

http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html

http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html

http://support.apple.com/kb/HT5880

http://marc.info/?l=bugtraq&m=136612293908376&w=2

http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19539

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18832

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

Details

Source: MITRE

Published: 2012-08-22

Updated: 2021-06-06

Type: CWE-79

Risk Information

CVSS v2

Base Score: 2.6

Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 4.9

Severity: LOW

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:apache:http_server:2.4.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.22:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.21:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.17:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.18:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.20:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.23:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.19:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*

Tenable Plugins

View all (35 total)

IDNameProductFamilySeverity
98901Apache 2.4.x < 2.4.3 Multiple VulnerabilitiesWeb Application ScanningComponent Vulnerability
medium
84878Juniper NSM < 2012.2R9 Apache HTTP Server Multiple Vulnerabilities (JSA10685) (credentialed check)NessusMisc.
medium
84877Juniper NSM < 2012.2R9 Apache HTTP Server Multiple Vulnerabilities (JSA10685)NessusMisc.
medium
83578SUSE SLES10 Security Update : apache2 (SUSE-SU-2013:0469-1)NessusSuSE Local Security Checks
medium
83577SUSE SLES10 Security Update : apache2 (SUSE-SU-2013:0387-1)NessusSuSE Local Security Checks
medium
80583Oracle Solaris Third-Party Patch Update : apache (multiple_vulnerabilities_in_apache_http2)NessusSolaris Local Security Checks
medium
80043openSUSE Security Update : apache2 (openSUSE-SU-2014:1647-1)NessusSuSE Local Security Checks
medium
79891F5 Networks BIG-IP : Apache HTTP server vulnerability (SOL15901)NessusF5 Networks Local Security Checks
low
75187openSUSE Security Update : apache2 (openSUSE-SU-2013:0245-1)NessusSuSE Local Security Checks
low
75181openSUSE Security Update : apache2 (openSUSE-SU-2013:0243-1)NessusSuSE Local Security Checks
medium
74964openSUSE Security Update : apache2 (openSUSE-SU-2013:0629-1)NessusSuSE Local Security Checks
medium
8008Mac OS X 10.8 < 10.8.5 Multiple Vulnerabilities (Security Update 2013-004)Nessus Network MonitorWeb Clients
critical
69878Mac OS X Multiple Vulnerabilities (Security Update 2013-004)NessusMacOS X Local Security Checks
critical
69877Mac OS X 10.8.x < 10.8.5 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
critical
69301Oracle Fusion Middleware Oracle HTTP Server Multiple VulnerabilitiesNessusWeb Servers
critical
68750Oracle Linux 6 : httpd (ELSA-2013-0512)NessusOracle Linux Local Security Checks
medium
68701Oracle Linux 5 : httpd (ELSA-2013-0130)NessusOracle Linux Local Security Checks
medium
65145CentOS 6 : httpd (CESA-2013:0512)NessusCentOS Local Security Checks
medium
65025SuSE 10 Security Update : apache2 (ZYPP Patch Number 8443)NessusSuSE Local Security Checks
medium
65023SuSE 11.2 Security Update : Apache (SAT Patch Number 7409)NessusSuSE Local Security Checks
medium
64952Scientific Linux Security Update : httpd on SL6.x i386/x86_64 (20130221)NessusScientific Linux Local Security Checks
medium
64761RHEL 6 : httpd (RHSA-2013:0512)NessusRed Hat Local Security Checks
medium
64595Fedora 17 : httpd-2.2.23-1.fc17 (2013-1661)NessusFedora Local Security Checks
medium
64072RHEL 6 : JBoss EAP (RHSA-2012:1592)NessusRed Hat Local Security Checks
critical
64071RHEL 5 : JBoss EAP (RHSA-2012:1591)NessusRed Hat Local Security Checks
critical
63597Scientific Linux Security Update : httpd on SL5.x i386/x86_64 (20130108)NessusScientific Linux Local Security Checks
medium
63575CentOS 5 : httpd (CESA-2013:0130)NessusCentOS Local Security Checks
medium
63411RHEL 5 : httpd (RHSA-2013:0130)NessusRed Hat Local Security Checks
medium
62869Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : apache2 vulnerabilities (USN-1627-1)NessusUbuntu Local Security Checks
low
62806FreeBSD : apache22 -- several vulnerabilities (65539c54-2517-11e2-b9d6-20cf30e32f6d)NessusFreeBSD Local Security Checks
low
62386Mandriva Linux Security Advisory : apache (MDVSA-2012:154-1)NessusMandriva Local Security Checks
medium
6576Apache 2.2 < 2.2.23 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
high
62101Apache 2.2.x < 2.2.23 Multiple VulnerabilitiesNessusWeb Servers
high
6550Apache 2.4.1, 2.4.2 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
medium
61644Apache 2.4.x < 2.4.3 Multiple VulnerabilitiesNessusWeb Servers
medium