CVE-2002-1157

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2002-11-04 · updated 2026-06-16

Description

Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.

Affected products

Mod Ssl: through 2.8.9

References

http://archives.neohapsis.com/archives/bugtraq/2002-10/0374.html
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000541
http://online.securityfocus.com/archive/1/296753
http://www.debian.org/security/2002/dsa-181
http://www.iss.net/security_center/static/10457.php
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-072.php
http://www.linuxsecurity.com/advisories/other_advisory-2512.html
http://www.osvdb.org/2107
http://www.redhat.com/support/errata/RHSA-2002-222.html
http://www.redhat.com/support/errata/RHSA-2002-243.html
http://www.redhat.com/support/errata/RHSA-2002-244.html
http://www.redhat.com/support/errata/RHSA-2002-248.html

Get alerted when CVE-2002-1157 or the next vulnerability affects your stack