CVE-2002-0840
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43,...
CVE-2002-0840 is a medium vulnerability (CVSS 6.8) in Apache Http Server, published October 11, 2002. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.1%, the 99th percentile. Fixed in apache2 2.0.43-1.
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
- Record
CVE-2002-0840- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
- Record
CVE-2002-0840- Updated
- 2026-11-02
EUVDEUVD-2002-0832 No score
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
- Record
EUVD-2002-0832- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rg25-cp4q-r4c8 No score
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43,...
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
- Record
GHSA-rg25-cp4q-r4c8- Updated
- 2026-11-02
OSVBELL-CVE-2002-0840
CVE-2002-0840 does not affect BellSoft software
- Record
BELL-CVE-2002-0840- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
- Record
CVE-2002-0840- Updated
- 2026-11-02
OSVDEBIAN-CVE-2002-0840 No score
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
- Record
DEBIAN-CVE-2002-0840- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 |
before 2.0.43-1 | 2.0.43-1 |
apache2Debian:13 |
before 2.0.43-1 | 2.0.43-1 |
apache2Debian:14 |
before 2.0.43-1 | 2.0.43-1 |
apacheDebian:3.0 |
before 1.3.26-0woody | 1.3.26-0woody |
apache-sslDebian:3.0 |
before 1.3.26.1+1.48-0woody3 | 1.3.26.1+1.48-0woody3 |
apache-perlDebian:3.0 |
before 1.3.26-1-1.26-0woody2 | 1.3.26-1-1.26-0woody2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache 1.3/2.0.x - Server Side Include Cross-Site Scripting | 2002-10-02 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
debian.org/security/2002/dsa-188
marc.info?l=apache-httpd-announce&m=103367938230488&w=2
linuxsecurity.com/advisories/other_advisory-2414.html
online.securityfocus.com/advisories/4617
apacheweek.com/issues/02-10-04
Show 47 moreShow less
linux-mandrake.com/en/security/2002/MDKSA-2002-068.php
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000530
archives.neohapsis.com/archives/bugtraq/2002-10/0254.html
redhat.com/support/errata/RHSA-2002-243.html
osvdb.org/862
exchange.xforce.ibmcloud.com/vulnerabilities/10241
kb.cert.org/vuls/id/240329
securityfocus.com/bid/5847
lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2002-0840
github.com/advisories/GHSA-rg25-cp4q-r4c8
docs.bell-sw.com/security/cves/CVE-2002-0840
security-tracker.debian.org/tracker/CVE-2002-0840