MEDIUM
httpd: Garbage before http method name is not escaped in a reply in case of errorneous request
Published Dec 3, 2007
4.3
MEDIUMCVSS 2.0
EPSS 80.75%
Description
Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
Affected products
No data.
OR
- 2.0.46
- 2.0.47
- 2.0.48
- 2.0.49
- 2.0.50
- 2.0.51
- 2.0.52
- 2.0.53
- 2.0.54
- 2.0.55
- 2.0.57
- 2.0.58
- 2.0.59
- 2.1.1
- 2.1.2
- 2.1.3
- 2.1.4
- 2.1.5
- 2.1.6
- 2.1.7
- 2.1.8
- 2.2.0
- 2.2.2
- 2.2.3
- 2.2.4
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat does not consider this issue to be a vulnerability. In order to exploit this for cross-site scripting, the attacker would have to get the victim to supply an arbitrary malformed HTTP method to a target site. However, this has been fixed in Red Hat Enterprise Linux 5 via RHBA-2009:0185 as a bug fix.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
4.3 MEDIUM NVD
AV:N/AC:M/Au:N/C:N/I:P/A:N
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
80.75% 0.80749
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.80749
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (46 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 80.75% (0.80749) | 99.62th | v5 (v2026.06.15) |
| Jun 15, 2026 | 80.75% (0.80749) | 99.58th | v5 (v2026.06.15) |
| Mar 4, 2026 | 73.14% (0.73143) | 98.76th | v4 (v2025.03.14) |
| Mar 1, 2026 | 74.82% (0.74817) | 98.84th | v4 (v2025.03.14) |
| Feb 4, 2026 | 72.21% (0.72212) | 98.71th | v4 (v2025.03.14) |
| Feb 1, 2026 | 73.95% (0.73946) | 98.79th | v4 (v2025.03.14) |
| Jan 4, 2026 | 72.21% (0.72212) | 98.70th | v4 (v2025.03.14) |
| Jan 1, 2026 | 73.95% (0.73946) | 98.79th | v4 (v2025.03.14) |
| Dec 28, 2025 | 72.21% (0.72212) | 98.69th | v4 (v2025.03.14) |
| Dec 27, 2025 | 74.69% (0.74685) | 98.82th | v4 (v2025.03.14) |
| Dec 4, 2025 | 72.21% (0.72212) | 98.69th | v4 (v2025.03.14) |
| Dec 1, 2025 | 73.95% (0.73946) | 98.77th | v4 (v2025.03.14) |
| Nov 9, 2025 | 72.21% (0.72212) | 98.69th | v4 (v2025.03.14) |
| Nov 4, 2025 | 76.25% (0.76251) | 98.87th | v4 (v2025.03.14) |
| Nov 1, 2025 | 77.72% (0.77716) | 98.95th | v4 (v2025.03.14) |
| Oct 28, 2025 | 76.25% (0.76251) | 98.87th | v4 (v2025.03.14) |
| Oct 27, 2025 | 74.69% (0.74685) | 98.80th | v4 (v2025.03.14) |
| Oct 4, 2025 | 76.25% (0.76251) | 98.89th | v4 (v2025.03.14) |
| Oct 1, 2025 | 77.72% (0.77716) | 98.96th | v4 (v2025.03.14) |
| Sep 4, 2025 | 74.69% (0.74685) | 98.82th | v4 (v2025.03.14) |
| Sep 1, 2025 | 76.17% (0.76175) | 98.89th | v4 (v2025.03.14) |
| Aug 4, 2025 | 74.69% (0.74685) | 98.80th | v4 (v2025.03.14) |
| Aug 1, 2025 | 76.17% (0.76175) | 98.88th | v4 (v2025.03.14) |
| Jul 30, 2025 | 74.69% (0.74685) | 98.80th | v4 (v2025.03.14) |
| Jul 4, 2025 | 76.25% (0.76251) | 98.86th | v4 (v2025.03.14) |
| Jul 1, 2025 | 77.72% (0.77716) | 98.94th | v4 (v2025.03.14) |
| Jun 4, 2025 | 76.25% (0.76251) | 98.86th | v4 (v2025.03.14) |
| Jun 1, 2025 | 77.72% (0.77716) | 98.94th | v4 (v2025.03.14) |
| May 4, 2025 | 76.25% (0.76251) | 98.85th | v4 (v2025.03.14) |
| May 1, 2025 | 77.72% (0.77716) | 98.93th | v4 (v2025.03.14) |
| Mar 17, 2025 | 76.25% (0.76251) | 98.87th | v4 (v2025.03.14) |
| Dec 17, 2024 | 96.10% (0.96101) | 99.64th | v3 (v2023.03.01) |
| Dec 12, 2024 | 97.13% (0.97134) | 99.84th | v3 (v2023.03.01) |
| Jun 14, 2024 | 97.20% (0.97199) | 99.83th | v3 (v2023.03.01) |
| May 6, 2024 | 97.23% (0.97233) | 99.83th | v3 (v2023.03.01) |
| Feb 22, 2024 | 97.20% (0.97200) | 99.80th | v3 (v2023.03.01) |
| Jan 15, 2024 | 97.03% (0.97031) | 99.70th | v3 (v2023.03.01) |
| Dec 9, 2023 | 96.91% (0.96907) | 99.64th | v3 (v2023.03.01) |
| Sep 29, 2023 | 97.15% (0.97152) | 99.72th | v3 (v2023.03.01) |
| Aug 24, 2023 | 97.10% (0.97097) | 99.67th | v3 (v2023.03.01) |
| Jul 19, 2023 | 97.13% (0.97134) | 99.67th | v3 (v2023.03.01) |
| May 8, 2023 | 97.19% (0.97185) | 99.67th | v3 (v2023.03.01) |
| Apr 1, 2023 | 97.00% (0.96997) | 99.54th | v3 (v2023.03.01) |
| Mar 7, 2023 | 96.97% (0.96971) | 99.50th | v3 (v2023.03.01) |
| Mar 6, 2023 | 73.11% (0.73110) | 99.27th | v2 (v2022.01.01) |
| Feb 4, 2022 | 73.11% (0.73110) | 99.11th | v2 (v2022.01.01) |
Weaknesses (1)
References (35)
- http://docs.info.apple.com/article.html?artnum=307562 x_refsource_CONFIRM
- http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html vendor-advisoryx_refsource_APPLE
- http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html vendor-advisoryx_refsource_SUSE
- http://marc.info/?l=bugtraq&m=125631037611762&w=2 vendor-advisoryx_refsource_HP
- http://marc.info/?l=bugtraq&m=129190899612998&w=2 vendor-advisoryx_refsource_HP
- http://procheckup.com/Vulnerability_PR07-37.php x_refsource_MISCExploit
- http://secunia.com/advisories/27906 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/28196 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/29348 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/29420 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/29640 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/30356 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/30732 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/33105 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/34219 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://security.gentoo.org/glsa/glsa-200803-19.xml vendor-advisoryx_refsource_GENTOO
- http://securityreason.com/securityalert/3411 third-party-advisoryx_refsource_SREASON
- http://www-1.ibm.com/support/docview.wss?uid=swg1PK57952 vendor-advisoryx_refsource_AIXAPAR
- http://www-1.ibm.com/support/docview.wss?uid=swg24019245 vendor-advisoryx_refsource_AIXAPAR
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.html x_refsource_CONFIRM
- http://www.securityfocus.com/archive/1/484410/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/bid/26663 vdb-entryx_refsource_BIDExploit
- http://www.securitytracker.com/id?1019030 vdb-entryx_refsource_SECTRACK
- http://www.ubuntu.com/usn/USN-731-1 vendor-advisoryx_refsource_UBUNTU
- http://www.vupen.com/english/advisories/2007/4060 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2007/4301 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2008/0924/references vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2008/1623/references vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2008/1875/references vdb-entryx_refsource_VUPEN
- https://access.redhat.com/security/cve/CVE-2007-6203 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=409831 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38800 vdb-entryx_refsource_XF
- https://nvd.nist.gov/vuln/detail/CVE-2007-6203
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12166 vdb-entrysignaturex_refsource_OVAL
- https://www.cve.org/CVERecord?id=CVE-2007-6203
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Dec 3, 2007
Updated Aug 7, 2024
Reserved Dec 3, 2007
Link CVE-2007-6203
CISA Vulnrichment
Updated n/a