CVE Feed

Dashboard / CVE / CVE-2006-5752

CVE-2006-5752

Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform "charset detection" when the content-type is not specified.

Published:Jun 20, 2007

Last Modified:Apr 23, 2026

EPS:Jun 27, 2007

EPSS Score:0.18368

CVSS Score:4.3

Affected Products

Vendor

Product

Action

Vendor

Apache

Product

Http Server

Apache

Http Server

Vendor

Canonical

Product

Ubuntu Linux

Canonical

Ubuntu Linux

Vendor

Fedoraproject

Product

Fedora

Fedoraproject

Fedora

Vendor

Redhat

Product

Certificate System

Redhat

Certificate System

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Vendor

Redhat

Product

Enterprise Linux Desktop

Redhat

Enterprise Linux Desktop

Vendor

Redhat

Product

Enterprise Linux Eus

Redhat

Enterprise Linux Eus

Vendor

Redhat

Product

Enterprise Linux Server

Redhat

Enterprise Linux Server

Vendor

Redhat

Product

Enterprise Linux Workstation

Redhat

Enterprise Linux Workstation

Vendor

Redhat

Product

Network Proxy

Redhat

Network Proxy

Vendor

Redhat

Product

Network Satellite

Redhat

Network Satellite

Vendor

Redhat

Product

Rhel Application Stack

Redhat

Rhel Application Stack

Exploits

No exploit reference

Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-209 XSS Using MIME Type Mismatch

CAPEC-588 DOM-Based XSS

CAPEC-591 Reflected XSS

CAPEC-592 Stored XSS

CAPEC-63 Cross-Site Scripting (XSS)

CAPEC-85 AJAX Footprinting

Related CVEs

CVE-2026-48913 (CVSS 7.3) — Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. …

CVE-2026-42536 (CVSS 7.5) — Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted…

CVE-2026-44185 (CVSS 7.3) — Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP…

CVE-2026-34355 (CVSS 7.5) — A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted …

CVE-2026-44631 (CVSS 9.8) — Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. Th…

CVE-2026-44119 (CVSS 5.5) — Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess au…

CVE-2026-43951 (CVSS 6.5) — Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response lan…

CVE-2026-42535 (CVSS 9.1) — A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly ma…

CVE-2026-34356 (CVSS 7.5) — Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassRev…

CVE-2026-44186 (CVSS 7.3) — Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTT…

References

http://bugs.gentoo.org/show_bug.cgi?id=186219

http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245112

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795

http://httpd.apache.org/security/vulnerabilities_13.html

http://httpd.apache.org/security/vulnerabilities_20.html

http://httpd.apache.org/security/vulnerabilities_22.html

http://lists.vmware.com/pipermail/security-announce/2009/000062.html

http://osvdb.org/37052

http://rhn.redhat.com/errata/RHSA-2007-0534.html

http://rhn.redhat.com/errata/RHSA-2007-0556.html

http://secunia.com/advisories/25827

http://secunia.com/advisories/25830

http://secunia.com/advisories/25873

http://secunia.com/advisories/25920

http://secunia.com/advisories/26273

http://secunia.com/advisories/26443

http://secunia.com/advisories/26458

http://secunia.com/advisories/26508

http://secunia.com/advisories/26822

http://secunia.com/advisories/26842

http://secunia.com/advisories/26993

http://secunia.com/advisories/27037

http://secunia.com/advisories/27563

http://secunia.com/advisories/27732

http://secunia.com/advisories/28212

http://secunia.com/advisories/28224

http://secunia.com/advisories/28606

http://security.gentoo.org/glsa/glsa-200711-06.xml

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1

http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1

http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm

http://svn.apache.org/viewvc?view=rev&revision=549159

http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702

http://www-1.ibm.com/support/search.wss?rs=0&q=PK49295&apar=only

http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html

http://www.mandriva.com/security/advisories?name=MDKSA-2007:140

http://www.mandriva.com/security/advisories?name=MDKSA-2007:141

http://www.mandriva.com/security/advisories?name=MDKSA-2007:142

http://www.novell.com/linux/security/advisories/2007_61_apache2.html

http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html

http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html

http://www.redhat.com/support/errata/RHSA-2007-0532.html

http://www.redhat.com/support/errata/RHSA-2007-0557.html

http://www.redhat.com/support/errata/RHSA-2008-0261.html

http://www.securityfocus.com/archive/1/505990/100/0/threaded

http://www.securityfocus.com/bid/24645

http://www.securitytracker.com/id?1018302

http://www.trustix.org/errata/2007/0026/

http://www.ubuntu.com/usn/usn-499-1

http://www.vupen.com/english/advisories/2007/2727

http://www.vupen.com/english/advisories/2007/3283

http://www.vupen.com/english/advisories/2007/3386

http://www.vupen.com/english/advisories/2007/4305

http://www.vupen.com/english/advisories/2008/0233

https://exchange.xforce.ibmcloud.com/vulnerabilities/35097

https://issues.rpath.com/browse/RPL-1500

https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10154

https://rhn.redhat.com/errata/RHSA-2007-0533.html

http://bugs.gentoo.org/show_bug.cgi?id=186219

http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245112

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795

http://httpd.apache.org/security/vulnerabilities_13.html

http://httpd.apache.org/security/vulnerabilities_20.html

http://httpd.apache.org/security/vulnerabilities_22.html

http://lists.vmware.com/pipermail/security-announce/2009/000062.html

http://osvdb.org/37052

http://rhn.redhat.com/errata/RHSA-2007-0534.html

http://rhn.redhat.com/errata/RHSA-2007-0556.html

http://secunia.com/advisories/25827

http://secunia.com/advisories/25830

http://secunia.com/advisories/25873

http://secunia.com/advisories/25920

http://secunia.com/advisories/26273

http://secunia.com/advisories/26443

http://secunia.com/advisories/26458

http://secunia.com/advisories/26508

http://secunia.com/advisories/26822

http://secunia.com/advisories/26842

http://secunia.com/advisories/26993

http://secunia.com/advisories/27037

http://secunia.com/advisories/27563

http://secunia.com/advisories/27732

http://secunia.com/advisories/28212

http://secunia.com/advisories/28224

http://secunia.com/advisories/28606

http://security.gentoo.org/glsa/glsa-200711-06.xml

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1

http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1

http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm

http://svn.apache.org/viewvc?view=rev&revision=549159

http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702

http://www-1.ibm.com/support/search.wss?rs=0&q=PK49295&apar=only

http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html

http://www.mandriva.com/security/advisories?name=MDKSA-2007:140

http://www.mandriva.com/security/advisories?name=MDKSA-2007:141

http://www.mandriva.com/security/advisories?name=MDKSA-2007:142

http://www.novell.com/linux/security/advisories/2007_61_apache2.html

http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html

http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html

http://www.redhat.com/support/errata/RHSA-2007-0532.html

http://www.redhat.com/support/errata/RHSA-2007-0557.html

http://www.redhat.com/support/errata/RHSA-2008-0261.html

http://www.securityfocus.com/archive/1/505990/100/0/threaded

http://www.securityfocus.com/bid/24645

http://www.securitytracker.com/id?1018302

http://www.trustix.org/errata/2007/0026/

http://www.ubuntu.com/usn/usn-499-1

http://www.vupen.com/english/advisories/2007/2727

http://www.vupen.com/english/advisories/2007/3283

http://www.vupen.com/english/advisories/2007/3386

http://www.vupen.com/english/advisories/2007/4305

http://www.vupen.com/english/advisories/2008/0233

https://exchange.xforce.ibmcloud.com/vulnerabilities/35097

https://issues.rpath.com/browse/RPL-1500

https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10154

https://rhn.redhat.com/errata/RHSA-2007-0533.html

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High