Read the docs
TI-2012-02324 Aliases CVE-2012-2687GHSA-8v5x-5rvv-5j4v

Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in…

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
Partial Red Hat: 12 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.

Why it matters now

EPSS 0.23091 97th percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 12 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 25

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableApache
cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableApache
cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableApache
cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableApache
cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*2.2.4VulnerableApache
cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:*2.2.6VulnerableApache
cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:*2.2.8VulnerableApache
cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:*2.2.9VulnerableApache
cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:*2.2.10VulnerableApache
cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:*2.2.11VulnerableApache
  • cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:* Versions 2.2.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:* Versions 2.2.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:* Versions 2.2.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:* Versions 2.2.11 Vulnerable ·Apache
Show 15 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:*2.2.12VulnerableApache
cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:*2.2.13VulnerableApache
cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:*2.2.14VulnerableApache
cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*2.2.15VulnerableApache
cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:*2.2.16VulnerableApache
cpe:2.3:a:apache:http_server:2.2.17:*:*:*:*:*:*:*2.2.17VulnerableApache
cpe:2.3:a:apache:http_server:2.2.18:*:*:*:*:*:*:*2.2.18VulnerableApache
cpe:2.3:a:apache:http_server:2.2.19:*:*:*:*:*:*:*2.2.19VulnerableApache
cpe:2.3:a:apache:http_server:2.2.20:*:*:*:*:*:*:*2.2.20VulnerableApache
cpe:2.3:a:apache:http_server:2.2.21:*:*:*:*:*:*:*2.2.21VulnerableApache
cpe:2.3:a:apache:http_server:2.2.22:*:*:*:*:*:*:*2.2.22VulnerableApache
cpe:2.3:a:apache:http_server:2.2.23:*:*:*:*:*:*:*2.2.23VulnerableApache
cpe:2.3:a:apache:http_server:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableApache
cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*2.4.1VulnerableApache
cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*2.4.2VulnerableApache
  • cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:* Versions 2.2.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:* Versions 2.2.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:* Versions 2.2.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:* Versions 2.2.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:* Versions 2.2.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.17:*:*:*:*:*:*:* Versions 2.2.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.18:*:*:*:*:*:*:* Versions 2.2.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.19:*:*:*:*:*:*:* Versions 2.2.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.20:*:*:*:*:*:*:* Versions 2.2.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.21:*:*:*:*:*:*:* Versions 2.2.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.22:*:*:*:*:*:*:* Versions 2.2.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.23:*:*:*:*:*:*:* Versions 2.2.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:* Versions 2.4.2 Vulnerable ·Apache

Remediation

Red Hat 5 advisories

  • RHSA-2013:0512 Released 2013-02-20 · Red Hat rating Low
    httpd security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Desktop (v. 6) httpd-2.2.15-26.el6, httpd-tools-2.2.15-26.el6
    • Red Hat Enterprise Linux Desktop Optional (v. 6) httpd-2.2.15-26.el6, httpd-devel-2.2.15-26.el6, httpd-manual-2.2.15-26.el6 +1
    • Red Hat Enterprise Linux HPC Node (v. 6) httpd-2.2.15-26.el6, httpd-tools-2.2.15-26.el6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) httpd-2.2.15-26.el6, httpd-devel-2.2.15-26.el6, httpd-manual-2.2.15-26.el6 +1
    • Red Hat Enterprise Linux Server (v. 6) httpd-2.2.15-26.el6, httpd-devel-2.2.15-26.el6, httpd-devel-2.2.15-26.el6.ppc +3
    • Red Hat Enterprise Linux Workstation (v. 6) httpd-2.2.15-26.el6, httpd-devel-2.2.15-26.el6, httpd-manual-2.2.15-26.el6 +2
  • RHSA-2013:0130 Released 2013-01-08 · Red Hat rating Low
    httpd security, bug fix, and enhancement update
    • Red Hat Enterprise Linux (v. 5 server) httpd-2.2.3-74.el5, httpd-2.2.3-74.el5.i386, httpd-2.2.3-74.el5.ia64 +13
    • Red Hat Enterprise Linux Desktop (v. 5 client) httpd-2.2.3-74.el5, httpd-2.2.3-74.el5.i386, mod_ssl-1:2.2.3-74.el5 +1
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) httpd-2.2.3-74.el5, httpd-devel-2.2.3-74.el5, httpd-devel-2.2.3-74.el5.i386 +2
  • RHSA-2012:1594 Released 2012-12-18 · Red Hat rating Important
    JBoss Enterprise Application Platform 6.0.1 update
    • Red Hat JBoss Enterprise Application Platform 6.0
Show 2 more Red Hat advisories
  • RHSA-2012:1592 Released 2012-12-18 · Red Hat rating Important
    JBoss Enterprise Application Platform 6.0.1 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server antlr-eap6-2.7.7-15_redhat_2.ep6.el6, apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el6, apache-commons-cli-1.2-7.5.redhat_2.ep6.el6.4 +47
  • RHSA-2012:1591 Released 2012-12-18 · Red Hat rating Important
    JBoss Enterprise Application Platform 6.0.1 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server antlr-eap6-2.7.7-15_redhat_2.ep6.el5, apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5, apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 +47

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Web Server 1AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2013:0130
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2013:0130
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2013:0512
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2013:0512
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2013:0130
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2013:0512
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2013:0512
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2013:0512
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2013:0512
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 ServerFixed RHSA-2012:1591
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 ServerFixed RHSA-2012:1592
Red Hat JBoss Enterprise Application Platform 6.0Fixed RHSA-2012:1594

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-2687
  2. 2026-10-03 Alias added: GHSA-8v5x-5rvv-5j4v

References

Advisory 12

Other 27

  • TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-25716 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
  • TI-2019-00184 Use after free in Apache HTTP Server KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 349 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences