CVE-2007-6420
Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for...
4.3 MediumFix available
CVE-2007-6420 is a medium vulnerability (CVSS 4.3) in Apache Http Server, published January 12, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.11%, the 95th percentile. Fixed in apache2 2.2.9-1.
Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
Exploit likelihood
9.11%Up 1.8 points since Feb 4, 2022
What each source reports
NVD Score used
Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
- Record
CVE-2007-6420- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
- Record
CVE-2007-6420- Updated
- 2026-11-02
EUVDEUVD-2007-6386 No score
Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
- Record
EUVD-2007-6386- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6p65-8p9q-94p9 No score
Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for...
Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
- Record
GHSA-6p65-8p9q-94p9- Weakness
- CWE-352
- Updated
- 2026-11-02
OSV No score
Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
- Record
CVE-2007-6420- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-6420 No score
Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
- Record
DEBIAN-CVE-2007-6420- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10623-1 No score
apache2-2.4.49-1.1 on GA media
These are all security issues fixed in the apache2-2.4.49-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10623-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 |
before 2.2.9-1 | 2.2.9-1 |
apache2Debian:13 |
before 2.2.9-1 | 2.2.9-1 |
apache2Debian:14 |
before 2.2.9-1 | 2.2.9-1 |
httpdRed Hat:rhel_application_stack:2 |
before 0:2.2.10-1.el5s2 | 0:2.2.10-1.el5s2 |
httpd-debuginfoRed Hat:rhel_application_stack:2 |
before 0:2.2.10-1.el5s2 | 0:2.2.10-1.el5s2 |
httpd-develRed Hat:rhel_application_stack:2 |
before 0:2.2.10-1.el5s2 | 0:2.2.10-1.el5s2 |
httpd-manualRed Hat:rhel_application_stack:2 |
before 0:2.2.10-1.el5s2 | 0:2.2.10-1.el5s2 |
mod_sslRed Hat:rhel_application_stack:2 |
before 1:2.2.10-1.el5s2 | 1:2.2.10-1.el5s2 |
mysqlRed Hat:rhel_application_stack:2 |
before 0:5.0.60sp1-1.el5s2 | 0:5.0.60sp1-1.el5s2 |
mysql-benchRed Hat:rhel_application_stack:2 |
before 0:5.0.60sp1-1.el5s2 | 0:5.0.60sp1-1.el5s2 |
Show 31 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mysql-clusterRed Hat:rhel_application_stack:2 |
before 0:5.0.60sp1-1.el5s2 | 0:5.0.60sp1-1.el5s2 |
mysql-connector-odbcRed Hat:rhel_application_stack:2 |
before 0:3.51.26r1127-1.el5s2 | 0:3.51.26r1127-1.el5s2 |
mysql-connector-odbc-debuginfoRed Hat:rhel_application_stack:2 |
before 0:3.51.26r1127-1.el5s2 | 0:3.51.26r1127-1.el5s2 |
mysql-debuginfoRed Hat:rhel_application_stack:2 |
before 0:5.0.60sp1-1.el5s2 | 0:5.0.60sp1-1.el5s2 |
mysql-develRed Hat:rhel_application_stack:2 |
before 0:5.0.60sp1-1.el5s2 | 0:5.0.60sp1-1.el5s2 |
mysql-libsRed Hat:rhel_application_stack:2 |
before 0:5.0.60sp1-1.el5s2 | 0:5.0.60sp1-1.el5s2 |
mysql-serverRed Hat:rhel_application_stack:2 |
before 0:5.0.60sp1-1.el5s2 | 0:5.0.60sp1-1.el5s2 |
mysql-testRed Hat:rhel_application_stack:2 |
before 0:5.0.60sp1-1.el5s2 | 0:5.0.60sp1-1.el5s2 |
perl-DBD-MySQLRed Hat:rhel_application_stack:2 |
before 0:4.008-2.el5s2 | 0:4.008-2.el5s2 |
perl-DBD-MySQL-debuginfoRed Hat:rhel_application_stack:2 |
before 0:4.008-2.el5s2 | 0:4.008-2.el5s2 |
perl-DBD-PgRed Hat:rhel_application_stack:2 |
before 0:1.49-4.el5s2 | 0:1.49-4.el5s2 |
perl-DBD-Pg-debuginfoRed Hat:rhel_application_stack:2 |
before 0:1.49-4.el5s2 | 0:1.49-4.el5s2 |
perl-DBIRed Hat:rhel_application_stack:2 |
before 0:1.607-3.el5s2 | 0:1.607-3.el5s2 |
perl-DBI-debuginfoRed Hat:rhel_application_stack:2 |
before 0:1.607-3.el5s2 | 0:1.607-3.el5s2 |
php-pearRed Hat:rhel_application_stack:2 |
before 1:1.7.2-2.el5s2 | 1:1.7.2-2.el5s2 |
postgresqlRed Hat:rhel_application_stack:2 |
before 0:8.2.11-1.el5s2 | 0:8.2.11-1.el5s2 |
postgresql-contribRed Hat:rhel_application_stack:2 |
before 0:8.2.11-1.el5s2 | 0:8.2.11-1.el5s2 |
postgresql-debuginfoRed Hat:rhel_application_stack:2 |
before 0:8.2.11-1.el5s2 | 0:8.2.11-1.el5s2 |
postgresql-develRed Hat:rhel_application_stack:2 |
before 0:8.2.11-1.el5s2 | 0:8.2.11-1.el5s2 |
postgresql-docsRed Hat:rhel_application_stack:2 |
before 0:8.2.11-1.el5s2 | 0:8.2.11-1.el5s2 |
postgresql-libsRed Hat:rhel_application_stack:2 |
before 0:8.2.11-1.el5s2 | 0:8.2.11-1.el5s2 |
postgresql-plperlRed Hat:rhel_application_stack:2 |
before 0:8.2.11-1.el5s2 | 0:8.2.11-1.el5s2 |
postgresql-plpythonRed Hat:rhel_application_stack:2 |
before 0:8.2.11-1.el5s2 | 0:8.2.11-1.el5s2 |
postgresql-pltclRed Hat:rhel_application_stack:2 |
before 0:8.2.11-1.el5s2 | 0:8.2.11-1.el5s2 |
postgresql-pythonRed Hat:rhel_application_stack:2 |
before 0:8.2.11-1.el5s2 | 0:8.2.11-1.el5s2 |
postgresql-serverRed Hat:rhel_application_stack:2 |
before 0:8.2.11-1.el5s2 | 0:8.2.11-1.el5s2 |
postgresql-tclRed Hat:rhel_application_stack:2 |
before 0:8.2.11-1.el5s2 | 0:8.2.11-1.el5s2 |
postgresql-testRed Hat:rhel_application_stack:2 |
before 0:8.2.11-1.el5s2 | 0:8.2.11-1.el5s2 |
postgresqlclient81Red Hat:rhel_application_stack:2 |
before 0:8.1.14-1.el5s2 | 0:8.1.14-1.el5s2 |
postgresqlclient81-debuginfoRed Hat:rhel_application_stack:2 |
before 0:8.1.14-1.el5s2 | 0:8.1.14-1.el5s2 |
apache2openSUSE:Tumbleweed |
before 2.4.49-1.1 | 2.4.49-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, facts, references, title | GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |
References
secunia.com/advisories/34219
securityreason.com/securityalert/3523
lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html
securityfocus.com/bid/31681
Show 81 moreShow less
ubuntu.com/usn/USN-731-1
vupen.com/english/advisories/2009/0320
redhat.com/support/errata/RHSA-2008-0966.html
security.gentoo.org/glsa/glsa-200807-06.xml
marc.info?l=bugtraq&m=123376588623823&w=2
lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
support.apple.com/kb/HT3216
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8371
lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2007-6420
github.com/advisories/GHSA-6p65-8p9q-94p9
security-tracker.debian.org/tracker/CVE-2007-6420
access.redhat.com/errata/RHSA-2008:0966
bugzilla.redhat.com/show_bug.cgi?id=451615
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0966.json
cve.org/CVERecord?id=CVE-2007-6420
suse.com/security/cve/CVE-2005-3352