Read the docs
TI-2002-00816 Aliases CVE-2002-0840GHSA-rg25-cp4q-r4c8

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before…

Priority HIGH 74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.

Why it matters now

EPSS 0.95087 99th percentileScored 2026-11-07
Fix Fixed Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 47

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:*1.3VulnerableApache
cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableApache
cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:*1.3.3VulnerableApache
cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:*1.3.4VulnerableApache
cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:*1.3.6VulnerableApache
cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*1.3.9VulnerableApache
cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:*1.3.11VulnerableApache
cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:*1.3.12VulnerableApache
cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:*1.3.14VulnerableApache
cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:*1.3.17VulnerableApache
  • cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:* Versions 1.3.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:* Versions 1.3.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:* Versions 1.3.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:* Versions 1.3.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:* Versions 1.3.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:* Versions 1.3.17 Vulnerable ·Apache
Show 37 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:*1.3.18VulnerableApache
cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:*1.3.19VulnerableApache
cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:*1.3.20VulnerableApache
cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:*1.3.22VulnerableApache
cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:*1.3.23VulnerableApache
cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:*1.3.24VulnerableApache
cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:*1.3.25VulnerableApache
cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:*1.3.26VulnerableApache
cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*2.0VulnerableApache
cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*2.0.28VulnerableApache
cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*2.0.32VulnerableApache
cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*2.0.35VulnerableApache
cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*2.0.36VulnerableApache
cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*2.0.37VulnerableApache
cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*2.0.38VulnerableApache
cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*2.0.39VulnerableApache
cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*2.0.40VulnerableApache
cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*2.0.41VulnerableApache
cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*2.0.42VulnerableApache
cpe:2.3:a:oracle:application_server:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableOracle
cpe:2.3:a:oracle:application_server:1.0.2.1s:*:*:*:*:*:*:*1.0.2.1sVulnerableOracle
cpe:2.3:a:oracle:application_server:1.0.2.2:*:*:*:*:*:*:*1.0.2.2VulnerableOracle
cpe:2.3:a:oracle:application_server:9.0.2:*:*:*:*:*:*:*9.0.2VulnerableOracle
cpe:2.3:a:oracle:application_server:9.0.2:r2:*:*:*:*:*:*9.0.2 r2VulnerableOracle
cpe:2.3:a:oracle:application_server:9.0.2.1:*:*:*:*:*:*:*9.0.2.1VulnerableOracle
cpe:2.3:a:oracle:database_server:8.1.7:*:*:*:*:*:*:*8.1.7VulnerableOracle
cpe:2.3:a:oracle:database_server:9.2.1:*:*:*:*:*:*:*9.2.1VulnerableOracle
cpe:2.3:a:oracle:database_server:9.2.2:*:*:*:*:*:*:*9.2.2VulnerableOracle
cpe:2.3:a:oracle:oracle8i:8.1.7:*:*:*:*:*:*:*8.1.7VulnerableOracle
cpe:2.3:a:oracle:oracle8i:8.1.7.1:*:*:*:*:*:*:*8.1.7.1VulnerableOracle
cpe:2.3:a:oracle:oracle8i:8.1.7_.0.0_enterprise:*:*:*:*:*:*:*8.1.7_.0.0_enterpriseVulnerableOracle
cpe:2.3:a:oracle:oracle8i:8.1.7_.1.0_enterprise:*:*:*:*:*:*:*8.1.7_.1.0_enterpriseVulnerableOracle
cpe:2.3:a:oracle:oracle9i:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
cpe:2.3:a:oracle:oracle9i:9.0.1:*:*:*:*:*:*:*9.0.1VulnerableOracle
cpe:2.3:a:oracle:oracle9i:9.0.1.2:*:*:*:*:*:*:*9.0.1.2VulnerableOracle
cpe:2.3:a:oracle:oracle9i:9.0.1.3:*:*:*:*:*:*:*9.0.1.3VulnerableOracle
cpe:2.3:a:oracle:oracle9i:9.0.2:*:*:*:*:*:*:*9.0.2VulnerableOracle
  • cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:* Versions 1.3.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:* Versions 1.3.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:* Versions 1.3.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:* Versions 1.3.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:* Versions 1.3.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:* Versions 1.3.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:* Versions 1.3.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:* Versions 1.3.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:* Versions 2.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:* Versions 2.0.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:* Versions 2.0.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:* Versions 2.0.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:* Versions 2.0.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:* Versions 2.0.38 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:* Versions 2.0.39 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:* Versions 2.0.40 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:* Versions 2.0.41 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:* Versions 2.0.42 Vulnerable ·Apache
  • cpe:2.3:a:oracle:application_server:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_server:1.0.2.1s:*:*:*:*:*:*:* Versions 1.0.2.1s Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_server:1.0.2.2:*:*:*:*:*:*:* Versions 1.0.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_server:9.0.2:*:*:*:*:*:*:* Versions 9.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_server:9.0.2:r2:*:*:*:*:*:* Versions 9.0.2 r2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_server:9.0.2.1:*:*:*:*:*:*:* Versions 9.0.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:database_server:8.1.7:*:*:*:*:*:*:* Versions 8.1.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:database_server:9.2.1:*:*:*:*:*:*:* Versions 9.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:database_server:9.2.2:*:*:*:*:*:*:* Versions 9.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle8i:8.1.7:*:*:*:*:*:*:* Versions 8.1.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle8i:8.1.7.1:*:*:*:*:*:*:* Versions 8.1.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle8i:8.1.7_.0.0_enterprise:*:*:*:*:*:*:* Versions 8.1.7_.0.0_enterprise Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle8i:8.1.7_.1.0_enterprise:*:*:*:*:*:*:* Versions 8.1.7_.1.0_enterprise Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle9i:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle9i:9.0.1:*:*:*:*:*:*:* Versions 9.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle9i:9.0.1.2:*:*:*:*:*:*:* Versions 9.0.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle9i:9.0.1.3:*:*:*:*:*:*:* Versions 9.0.1.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle9i:9.0.2:*:*:*:*:*:*:* Versions 9.0.2 Vulnerable ·Oracle

Remediation

Red Hat 5 advisories

  • RHSA-2003:106 Released 2003-04-22 · Red Hat rating Important
    : : : Updated apache and mod_ssl packages available
    • Red Hat Linux 7.1
  • RHSA-2002:251 Released 2003-01-09 · Red Hat rating Important
    apache security update
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1
    • Red Hat Linux Advanced Workstation 2.1
  • RHSA-2002:244 Released 2002-11-08 · Red Hat rating Important
    apache, mod_ssl, php security update for Stronghold
    • Red Hat Stronghold 4
Show 2 more Red Hat advisories
  • RHSA-2002:243 Released 2002-11-08 · Red Hat rating Important
    apache, mod_ssl, php security update for Stronghold
    • Red Hat Stronghold 3
  • RHSA-2002:248 Released 2002-11-07 · Red Hat rating Important
    apache, mod_ssl, php security update for Stronghold
    • Stronghold 4 for Red Hat Enterprise Linux

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Fixed RHSA-2002:251
Red Hat Linux 6.2Fixed RHSA-2002:222
Red Hat Linux 7.0Fixed RHSA-2002:222
Red Hat Linux 7.1Fixed RHSA-2002:222
Red Hat Linux 7.2Fixed RHSA-2002:222
Red Hat Linux 7.3Fixed RHSA-2002:222
Red Hat Linux 8.0Fixed RHSA-2002:222
Red Hat Linux Advanced Workstation 2.1Fixed RHSA-2002:251
Red Hat Stronghold 3Fixed RHSA-2002:243
Red Hat Stronghold 4Fixed RHSA-2002:244
Stronghold 4 for Red Hat Enterprise LinuxFixed RHSA-2002:248

Timeline

  1. 2026-10-02 Threatist record created from CVE-2002-0840
  2. 2026-10-03 Alias added: GHSA-rg25-cp4q-r4c8

References

Advisory 14

Other 19

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences