Apache HTTP Server up to 1.3.11 printenv.pl ap_send_error_response cross site scripting

Summaryinfo

A vulnerability labeled as critical has been found in Apache HTTP Server up to 1.3.11. This affects the function ap_send_error_response of the file printenv.pl. Executing a manipulation can lead to cross site scripting. This vulnerability appears as CVE-2000-1205. The attack may be performed from remote. There is no available exploit. This vulnerability has historical importance owing to its background and reception. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Apache HTTP Server up to 1.3.11 (Web Server). It has been declared as critical. This vulnerability affects the function ap_send_error_response of the file printenv.pl. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache modules or core code. NOTE: the printenv issue might still exist for web browsers that can render text/plain content types as HTML, such as Internet Explorer, but CVE regards this as a design limitation of those browsers, not Apache. The printenv.pl/acuparam vector, discloser on 20070724, is one such variant.

The weakness was presented 02/01/2000 as not defined advisory (Website). The advisory is available at httpd.apache.org. This vulnerability was named CVE-2000-1205. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 04/20/2026). This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project. This vulnerability has a historic impact due to its background and reception.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 86817 (Apache 1.3 HTTP Server Cross-Site Scripting Vulnerabilities).

Upgrading to version 1.3.12 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (10938), SecurityFocus (BID 4431†) and Vulnerability Center (SBV-4304†). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Web Server

Vendor

• Apache

Name

• HTTP Server

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.3.9
• 1.3.10
• 1.3.11

License

• open-source

Support

• end of life (old version)

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion