01 Record

CVE-2007-4465

Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject

MediumPUBLISHEDCNA: mitre

CNA base score6.1 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

View raw JSON

02 Description

Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

26.19% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 97.8% of scored records. A rank, not a probability.

NVD base score

6.1 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-06-16.

Red Hat severity

Low. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2007-09-14 00:00Z18 YR AGO

Last updated

2025-01-17 14:50Z1 YR AGO

Reserved

2007-08-21

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Medium (CVSS 6.1)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Base

Data version

5.1

Document digest

d1a2fabcbb0d8ee535d7d46718a89a4797d8040cc76d7772cb8a4249f95e3aad

05 Affected products

VendorProductVersionsPlatforms

apachehttp_serverNot specified—

redhatcertificate_systemNot specified—

redhatenterprise_linuxNot specified—

redhatnetwork_proxyNot specified—

redhatnetwork_satelliteNot specified—

redhatrhel_application_stackNot specified—

06 References

www.redhat.comRHSA-2008:0005http://www.redhat.com/support/errata/RHSA-2008-0005.htmlvendor-advisoryx_refsource_REDHAT
securityreason.com3113http://securityreason.com/securityalert/3113third-party-advisoryx_refsource_SREASON
secunia.com28749http://secunia.com/advisories/28749third-party-advisoryx_refsource_SECUNIA
oval.cisecurity.orgoval:org.mitre.oval:def:6089https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6089vdb-entrysignaturex_refsource_OVAL
marc.infoHPSBUX02465http://marc.info/?l=bugtraq&m=125631037611762&w=2vendor-advisoryx_refsource_HP
secunia.com26952http://secunia.com/advisories/26952third-party-advisoryx_refsource_SECUNIA
secunia.com31651http://secunia.com/advisories/31651third-party-advisoryx_refsource_SECUNIA
marc.infoSSRT090085http://marc.info/?l=bugtraq&m=124654546101607&w=2vendor-advisoryx_refsource_HP
www.securityfocus.com25653http://www.securityfocus.com/bid/25653vdb-entryx_refsource_BID
secunia.com27563http://secunia.com/advisories/27563third-party-advisoryx_refsource_SECUNIA
secunia.com27732http://secunia.com/advisories/27732third-party-advisoryx_refsource_SECUNIA
securitytracker.com1019194http://securitytracker.com/id?1019194vdb-entryx_refsource_SECTRACK
www.redhat.comRHSA-2007:0911http://www.redhat.com/support/errata/RHSA-2007-0911.htmlvendor-advisoryx_refsource_REDHAT
www.redhat.comRHSA-2008:0006http://www.redhat.com/support/errata/RHSA-2008-0006.htmlvendor-advisoryx_refsource_REDHAT
www.securityfocus.com20070912 Apache2 Undefined Charset UTF-7 XSS Vulnerabilityhttp://www.securityfocus.com/archive/1/479237/100/0/threadedmailing-listx_refsource_BUGTRAQ
oval.cisecurity.orgoval:org.mitre.oval:def:10929https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10929vdb-entrysignaturex_refsource_OVAL
www.us-cert.govTA08-150Ahttp://www.us-cert.gov/cas/techalerts/TA08-150A.htmlthird-party-advisoryx_refsource_CERT
www.novell.comSUSE-SA:2007:061http://www.novell.com/linux/security/advisories/2007_61_apache2.htmlvendor-advisoryx_refsource_SUSE
www.redhat.comFEDORA-2007-2214http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.htmlvendor-advisoryx_refsource_FEDORA
www.redhat.comRHSA-2008:0008http://www.redhat.com/support/errata/RHSA-2008-0008.htmlvendor-advisoryx_refsource_REDHAT
www.mandriva.comMDVSA-2008:014http://www.mandriva.com/security/advisories?name=MDVSA-2008:014vendor-advisoryx_refsource_MANDRIVA
h20000.www2.hp.comHPSBUX02365http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432vendor-advisoryx_refsource_HP
secunia.com30430http://secunia.com/advisories/30430third-party-advisoryx_refsource_SECUNIA
www.apache.orghttp://www.apache.org/dist/httpd/CHANGES_2.2.6x_refsource_CONFIRM
lists.apple.comAPPLE-SA-2008-05-28http://lists.apple.com/archives/security-announce/2008//May/msg00001.htmlvendor-advisoryx_refsource_APPLE
support.avaya.comhttp://support.avaya.com/elmodocs2/security/ASA-2008-032.htmx_refsource_CONFIRM
secunia.com33105http://secunia.com/advisories/33105third-party-advisoryx_refsource_SECUNIA
exchange.xforce.ibmcloud.comapache-utf7-xss(36586)https://exchange.xforce.ibmcloud.com/vulnerabilities/36586vdb-entryx_refsource_XF
secunia.com28467http://secunia.com/advisories/28467third-party-advisoryx_refsource_SECUNIA
www.fujitsu.comhttp://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.htmlx_refsource_CONFIRM
www.redhat.comRHSA-2008:0004http://www.redhat.com/support/errata/RHSA-2008-0004.htmlvendor-advisoryx_refsource_REDHAT
secunia.com28607http://secunia.com/advisories/28607third-party-advisoryx_refsource_SECUNIA
security.gentoo.orgGLSA-200711-06http://security.gentoo.org/glsa/glsa-200711-06.xmlvendor-advisoryx_refsource_GENTOO
www.redhat.comFEDORA-2007-707https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00353.htmlvendor-advisoryx_refsource_FEDORA
secunia.com28471http://secunia.com/advisories/28471third-party-advisoryx_refsource_SECUNIA
www.vupen.comADV-2008-1697http://www.vupen.com/english/advisories/2008/1697vdb-entryx_refsource_VUPEN
securityreason.com20070912 Apache2 Undefined Charset UTF-7 XSS Vulnerabilityhttp://securityreason.com/achievement_securityalert/46third-party-advisoryx_refsource_SREASONRES
www.redhat.comRHSA-2008:0261http://www.redhat.com/support/errata/RHSA-2008-0261.htmlvendor-advisoryx_refsource_REDHAT
www.ubuntu.comUSN-575-1http://www.ubuntu.com/usn/usn-575-1vendor-advisoryx_refsource_UBUNTU
secunia.com26842http://secunia.com/advisories/26842third-party-advisoryx_refsource_SECUNIA
secunia.com35650http://secunia.com/advisories/35650third-party-advisoryx_refsource_SECUNIA
bugs.gentoo.orghttp://bugs.gentoo.org/show_bug.cgi?id=186219x_refsource_CONFIRM

01 Record index

CVE-2007-4465

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2007-4465

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References