CVE-2002-1157
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when...
CVE-2002-1157 is a high vulnerability (CVSS 7.5) in Mod Ssl Ssl, published October 22, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.1%, the 95th percentile. Fixed in libapache-mod-ssl 2.8.9-2.1.
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
- Record
CVE-2002-1157- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
- Record
CVE-2002-1157- Updated
- 2026-11-02
EUVDEUVD-2002-1144 No score
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
- Record
EUVD-2002-1144- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-42vq-2xjj-6g8w No score
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when...
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
- Record
GHSA-42vq-2xjj-6g8w- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libapache-mod-sslDebian:3.0 |
before 2.8.9-2.1, plus listed versions 2.4.10-1.3.9-1potato22.4.10-1.3.9-1potato42.8.7-1 |
2.8.9-2.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
archives.neohapsis.com/archives/bugtraq/2002-10/0374.html
redhat.com/support/errata/RHSA-2002-243.html
securityfocus.com/bid/6029
Show 11 moreShow less
debian.org/security/2002/dsa-181
osvdb.org/2107
linuxsecurity.com/advisories/other_advisory-2512.html
iss.net/security_center/static/10457.php
linux-mandrake.com/en/security/2002/MDKSA-2002-072.php
online.securityfocus.com/archive/1/296753
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000541
nvd.nist.gov/vuln/detail/CVE-2002-1157
github.com/advisories/GHSA-42vq-2xjj-6g8w