Advisory details:
apache_httpd / CVE-2006-3918
| Advisory ID | apache_httpd/CVE-2006-3918 |
| Aliases | |
| Summary | A flaw in the handling of invalid Expect headers. If an attacker can influence the Expect header that a victim sends to a target site they could perform a cross-site scripting attack. It is known that some versions of Flash can set an arbitrary Expect header which can trigger this flaw. Not marked as a security issue for 2.0 or 2.2 as the cross-site scripting is only returned to the victim after the server times out a connection. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| apache_httpd | moderate |
| Reference id | Reference type | URL |
|---|---|---|
| CVE-2006-3918 | https://httpd.apache.org/security/json/CVE-2006-3918.json |
| Data source | Exploit-DB |
|---|---|
| Date added | Aug. 24, 2006 |
| Description | Apache 1.3.35/2.0.58/2.2.2 - Arbitrary HTTP Request Headers Security |
| Ransomware campaign use | Known |
| Source publication date | Aug. 24, 2006 |
| Exploit type | remote |
| Platform | linux |
| Source update date | Sept. 21, 2013 |
| Source URL | https://www.securityfocus.com/bid/19661/info |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.