製品・ソフトウェアに関する情報
Vulnerability Search
Hitachi Web Server のステータス情報表示機能におけるクロスサイトスクリプティングの脆弱性
Title Hitachi Web Server のステータス情報表示機能におけるクロスサイトスクリプティングの脆弱性
Summary

Hitachi Web Server のステータス情報表示画面に追加された不正なスクリプトが含まれたリクエストを受信した際に、Hitachi Web Server が自動生成するステータス情報表示画面にその不正なスクリプトが追加され、それがクライアント上で実行される脆弱性が存在します。 本脆弱性は、ステータス情報表示機能を使用していない場合は影響を受けない事がベンダより報告されています。

Possible impacts 第三者によって不正なスクリプトが実行される可能性があります。
Solution

ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date Oct. 5, 2007, midnight
Registration Date Oct. 23, 2007, 3:56 p.m.
Last Update May 21, 2014, 6:27 p.m.
CVSS2.0 : 警告
Score 4.3
Vector AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected System
日立
Cosminexus Application Server Enterprise Version 6
Cosminexus Application Server Standard Version 6
Cosminexus Application Server Version 5 
Cosminexus Developer Light Version 6 
Cosminexus Developer Professional Version 6 
Cosminexus Developer Standard Version 6 
Cosminexus Developer Version 5 
Cosminexus Server - Enterprise Edition 
Cosminexus Server - Standard Edition 
Cosminexus Server - Standard Edition Version 4 
Cosminexus Server - Web Edition 
Cosminexus Server - Web Edition Version 4 
Hitachi Web Server 
uCosminexus Application Server Enterprise 
uCosminexus Application Server Standard 
uCosminexus Developer Professional
uCosminexus Developer Light 
uCosminexus Developer Standard 
uCosminexus Service Architect 
uCosminexus Service Platform 
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
その他
Change Log
No Changed Details Date of change
0 [2007年10月23日]
  掲載
[2014年05月21日]
  参考情報：Common Vulnerabilities and Exposures (CVE) (CVE-2006-5752) を追加
  参考情報：National Vulnerability Database (NVD) (CVE-2006-5752) を追加		 Feb. 17, 2018, 10:37 a.m.
NVD Vulnerability Information
CVE-2006-5752
Summary

Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform "charset detection" when the content-type is not specified.

Publication Date June 28, 2007, 2:30 a.m.
Registration Date Jan. 29, 2021, 3:49 p.m.
Last Update Nov. 7, 2023, 10:59 a.m.
Affected software configurations
Configuration1 or higher or less more than less than
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* 2.2.0 2.2.6
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* 2.0.0 2.0.61
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* 1.3.2 1.3.39
Configuration2 or higher or less more than less than
cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
Configuration3 or higher or less more than less than
cpe:2.3:o:fedoraproject:fedora:7:*:*:*:*:*:*:*
Configuration4 or higher or less more than less than
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:3.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:3.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:4.5:*:*:*:*:*:*:*
Related information, measures and tools
Common Vulnerabilities List
CVE-2007-5809
Summary

Cross-site scripting (XSS) vulnerability in Hitachi Web Server 01-00 through 03-10, as used by certain Cosminexus products, allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP requests that trigger creation of a server-status page.

Publication Date Nov. 6, 2007, 2:46 a.m.
Registration Date Jan. 29, 2021, 2:23 p.m.
Last Update March 8, 2011, 12:01 p.m.
Affected software configurations
Configuration1 or higher or less more than less than
cpe:2.3:a:hitachi:cosminexus_application_server_enterprise:*:*:*:*:*:*:*:* 06_51_j
cpe:2.3:a:hitachi:cosminexus_application_server_standard:*:*:*:*:*:*:*:* 06_51_j
cpe:2.3:a:hitachi:cosminexus_developer_light_version_6:*:*:*:*:*:*:*:* 06_51_j
cpe:2.3:a:hitachi:cosminexus_developer_professional_version_6:*:*:*:*:*:*:*:* 06_51_j
cpe:2.3:a:hitachi:cosminexus_developer_standard_version_6:*:*:*:*:*:*:*:* 06_51_j
cpe:2.3:a:hitachi:cosminexus_server:*:*:*:*:*:*:*:* 04_01
cpe:2.3:a:hitachi:ucosminexus_application_server_enterprise:*:*:*:*:*:*:*:* 07_50_01
cpe:2.3:a:hitachi:ucosminexus_application_server_standard:*:*:*:*:*:*:*:* 07_50_01
cpe:2.3:a:hitachi:ucosminexus_developer_light:*:*:*:*:*:*:*:* 06_71_d
cpe:2.3:a:hitachi:ucosminexus_developer_professional:*:*:*:*:*:*:*:* 07_50_01
cpe:2.3:a:hitachi:ucosminexus_developer_standard:*:*:*:*:*:*:*:* 07_50_01
cpe:2.3:a:hitachi:ucosminexus_service_architect:*:*:*:*:*:*:*:* 07_50_01
cpe:2.3:a:hitachi:ucosminexus_service_platform:*:*:*:*:*:*:*:* 07_50_01
cpe:2.3:a:hitachi:web_server:01_00:*:hpux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:01_00:*:solaris:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:01_01:*:aix:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:01_01:*:linux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:01_01:*:turbolinux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:01_01_d:*:linux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:01_02_d:*:hpux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:01_02_d:*:solaris:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:01_02_e:*:aix:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_00:*:aix:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_00:*:hpux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_00:*:linux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_00:*:solaris:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_00:*:turbolinux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_00:*:windows:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_00_a:*:linux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_02:*:hpux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_02:*:hpux\(ipf\):*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_02:*:linux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_04_b:*:aix:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_04_b:*:hpux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_04_b:*:hpux\(ipf\):*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_04_b:*:solaris:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_04_b:*:windows:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:02_06_a:*:linux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:03_00:*:aix:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:03_00:*:hpux\(ipf\):*:*:*:*:*
cpe:2.3:a:hitachi:web_server:03_00:*:linux:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:03_00:*:windows:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:03_00_01:*:solaris:*:*:*:*:*
cpe:2.3:a:hitachi:web_server:03_00_01:*:windows:*:*:*:*:*
Related information, measures and tools
Common Vulnerabilities List