CVE-2007-6203

Published: Dec 3, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.

Affected (25)

Products: Apache: Http Server

Apache

1 product

Http Server

Configuration A

25 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	Version 2.0.46
Apache Http Server	Version 2.0.47
Apache Http Server	Version 2.0.48
Apache Http Server	Version 2.0.49
Apache Http Server	Version 2.0.50
Apache Http Server	Version 2.0.51
Apache Http Server	Version 2.0.52
Apache Http Server	Version 2.0.53
Apache Http Server	Version 2.0.54
Apache Http Server	Version 2.0.55
Apache Http Server	Version 2.0.57
Apache Http Server	Version 2.0.58
Apache Http Server	Version 2.0.59
Apache Http Server	Version 2.1.1
Apache Http Server	Version 2.1.2
Apache Http Server	Version 2.1.3
Apache Http Server	Version 2.1.4
Apache Http Server	Version 2.1.5
Apache Http Server	Version 2.1.6
Apache Http Server	Version 2.1.7
Apache Http Server	Version 2.1.8
Apache Http Server	Version 2.2.0
Apache Http Server	Version 2.2.2
Apache Http Server	Version 2.2.3
Apache Http Server	Version 2.2.4

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (62)

http://docs.info.apple.com/article.html?artnum=307562

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=125631037611762&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=129190899612998&w=2

Source: cve@mitre.org

http://procheckup.com/Vulnerability_PR07-37.php

Source: cve@mitre.org

Exploit

http://secunia.com/advisories/27906

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28196

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29348

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29420

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29640

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/30356

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/30732

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/33105

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/34219

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200803-19.xml

Source: cve@mitre.org

http://securityreason.com/securityalert/3411

Source: cve@mitre.org

http://www-1.ibm.com/support/docview.wss?uid=swg1PK57952

Source: cve@mitre.org

http://www-1.ibm.com/support/docview.wss?uid=swg24019245

Source: cve@mitre.org

http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/484410/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/26663

Source: cve@mitre.org

Exploit

http://www.securitytracker.com/id?1019030

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-731-1

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/4060

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/4301

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0924/references

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/1623/references

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/1875/references

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/38800

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12166

Source: cve@mitre.org

http://docs.info.apple.com/article.html?artnum=307562