CVE-2002-0840

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.

Scoring

CVSS base score

3.64

EPSS probability

91.10%

Published

2004-09-01

Last modified

2026-03-16

Affected products

• n/a n/a

Markdown version · Browse all CVEs