CVE-2006-5752: Apache HTTP Server

Medium severity, CVSS 4.3. EPSS: 27.8% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform "charset detection" when the content-type is not specified.

Affected products

• Apache HTTP Server: from 1.3.2, before 1.3.39 (fixed in 1.3.39); from 2.0.0, before 2.0.61 (fixed in 2.0.61); from 2.2.0, before 2.2.6 (fixed in 2.2.6)
• Canonical Ubuntu Linux: version 6.06 only; version 6.10 only; version 7.04 only
• Fedoraproject Fedora: version 7 only
• Red Hat Enterprise Linux Desktop: version 3.0 only; version 4.0 only; version 5.0 only
• Red Hat Enterprise Linux Eus: version 4.5 only
• Red Hat Enterprise Linux Server: version 3.0 only; version 4.0 only; version 5.0 only
• Red Hat Enterprise Linux Workstation: version 3.0 only; version 4.0 only; version 5.0 only

Published 2007-06-27. Last modified 2026-06-16.