CVE-2006-3918
CVE-2006-3918
Vexday Risk Score
45Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Proof of concept
Public proof of concept exists, but not yet automated.
CVSS —EPSS 94.9%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado
Lifecycle
28 Jul 2006Published on NVD
24 Aug 2006Public PoC
Weaponization speed
27 daysto first PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
Affected products
n/a · n/apublic PoCs found — 2
githubgithub.com/reallyngb/badstore-webapp-pentest★ 0exploitdbwww.exploit-db.com/exploits/28424unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
ftp://patches.sgi.com/support/free/security/advisories/20060801-01-Phttp://archives.neohapsis.com/archives/bugtraq/2006-05/0151.htmlhttp://archives.neohapsis.com/archives/bugtraq/2006-07/0425.htmlhttp://kb.vmware.com/KanisaPlatform/Publishing/466/5915871_f.SAL_Public.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.htmlhttp://marc.info/?l=bugtraq&m=125631037611762&w=2http://marc.info/?l=bugtraq&m=129190899612998&w=2http://marc.info/?l=bugtraq&m=130497311408250&w=2http://openbsd.org/errata.html#httpd2http://rhn.redhat.com/errata/RHSA-2006-0618.htmlhttp://rhn.redhat.com/errata/RHSA-2006-0692.htmlhttp://secunia.com/advisories/21172