CVE-2002-1157
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when...
CVE-2002-1157 is a high vulnerability (CVSS 7.5) in Mod Ssl Ssl, published October 22, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.1%, the 96th percentile. Fixed in libapache-mod-ssl 2.8.9-2.1.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 11.1%EPSS, 96th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.8.9-2.1libapache-mod-ssl
Description
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libapache-mod-sslDebian:3.0 | before 2.8.9-2.1, plus listed versions 2.4.10-1.3.9-1potato22.4.10-1.3.9-1potato42.8.7-1 | 2.8.9-2.1 |
What each source reports
NVD Score used
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
- Record
CVE-2002-1157- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
- Record
CVE-2002-1157- Updated
- 2026-11-02
EUVDEUVD-2002-1144No score
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
- Record
EUVD-2002-1144- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-42vq-2xjj-6g8wNo score
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when...
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
- Record
GHSA-42vq-2xjj-6g8w- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
archives.neohapsis.com/archives/bugtraq/2002-10/0374.html
redhat.com/support/errata/RHSA-2002-243.html
securityfocus.com/bid/6029
Show 11 moreShow less
debian.org/security/2002/dsa-181
osvdb.org/2107
linuxsecurity.com/advisories/other_advisory-2512.html
iss.net/security_center/static/10457.php
linux-mandrake.com/en/security/2002/MDKSA-2002-072.php
online.securityfocus.com/archive/1/296753
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000541
nvd.nist.gov/vuln/detail/CVE-2002-1157
github.com/advisories/GHSA-42vq-2xjj-6g8w