Sid 1-45307

Rule Documentation
References

Rule Category

SERVER-APACHE -- Snort has detected traffic exploiting vulnerabilities in Apache servers.

Alert Message

SERVER-APACHE Apache SSI error page cross-site scripting attempt

Rule Explanation

This event is generated when a cross-site scripting attempt is detected in Apache SSI. Impact: Web Application Attack Details: Ease of Attack:

What To Look For

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

CVE-2002-0840

Rule Vulnerability

CVE Additional Information

CVE-2002-0840

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.

Details
Severity	MEDIUM	Base Score	6.8
Impact Score	6.4	Exploit Score	8.6
Confidentiality Impact	PARTIAL	Integrity Impact	PARTIAL
Availability Impact	PARTIAL	Access Vector
Authentication	NONE	Ease of Access