CVE-2006-5752

27

FAUCET Score

CVE-2006-5752 describes a Cross-site Scripting (XSS) vulnerability in the mod_status module of Apache HTTP Server, affecting various distributions including Apache, Canonical, Fedora Project, and Red Hat, when ExtendedStatus is enabled and a public server-status page is in use. This vulnerability allows remote attackers to inject arbitrary web script or HTML through unspecified vectors, leveraging browsers that perform charset detection when the content-type is not specified. With a CVSS score of 4.3, it is of medium complexity to exploit over the network, leading to a partial impact on integrity without affecting confidentiality or availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 1.3.2, < 1.3.39CPE matchmatch criteria	cpe:2.3:a:apache:http_server::::::::
		>= 2.0.0, < 2.0.61CPE matchmatch criteria	cpe:2.3:a:apache:http_server::::::::
		>= 2.2.0, < 2.2.6CPE matchmatch criteria	cpe:2.3:a:apache:http_server::::::::
		6.06CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*
		6.10CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:6.10:::::::*

CVSS Data

CVSS version used by this source: 2.0

4.3MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Exploitability Score

8.6

Impact Score

2.9

CvssVersion

2.0

Exploit Intelligence

EPSS Score

27.78%

Probability of exploitation in next 30 days

EPSS Percentile

97.9%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.2778 is in the 98th percentile among its peer group of 19,958 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (64)

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: ant-0:1.6.5-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: avalon-logkit-0:1.2-2jpp_4rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: axis-0:1.2.1-1jpp_3rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: classpathx-jaf-0:1.0-2jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: classpathx-mail-0:1.1.1-2jpp_8rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: geronimo-specs-0:1.0-0.M4.1jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: jakarta-commons-modeler-0:2.0-3jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: log4j-0:1.2.12-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: mx4j-1:3.0.1-1jpp_4rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: pcsc-lite-0:1.3.3-3.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-ca-0:7.3.0-20.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-java-tools-0:7.3.0-10.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-kra-0:7.3.0-14.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-manage-0:7.3.0-19.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-native-tools-0:7.3.0-6.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-ocsp-0:7.3.0-13.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-tks-0:7.3.0-13.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: tomcat5-0:5.5.23-0jpp_4rh.16

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: xerces-j2-0:2.7.1-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: xml-commons-0:1.3.02-2jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 2.1Fixed in: apache-0:1.3.27-12.ent

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 3Fixed in: httpd-0:2.0.46-67.ent

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 4Fixed in: httpd-0:2.0.52-32.2.ent

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: httpd-0:2.2.3-7.el5

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 3)Fixed in: jabberd-0:2.0s10-3.37.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 3)Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 3)Fixed in: rhn-modperl-0:1.29-16.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 4)Fixed in: jabberd-0:2.0s10-3.38.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 4)Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 4)Fixed in: rhn-modperl-0:1.29-16.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 5.0Fixed in: jabberd-0:2.0s10-3.38.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 5.0Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 5.0Fixed in: rhn-modperl-0:1.29-16.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: jabberd-0:2.0s10-3.38.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: jfreechart-0:0.9.20-3.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: openmotif21-0:2.1.30-11.RHEL4.6

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: perl-Crypt-CBC-0:2.24-1.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-modjk-0:1.2.23-2rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-modperl-0:1.29-16.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-modssl-0:2.8.12-8.rhn.10.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: tomcat5-0:5.0.30-0jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: jabberd-0:2.0s10-3.37.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: jfreechart-0:0.9.20-3.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: openmotif21-0:2.1.30-9.RHEL3.8

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: perl-Crypt-CBC-0:2.24-1.el3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-modjk-0:1.2.23-2rhn.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-modperl-0:1.29-16.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-modssl-0:2.8.12-8.rhn.10.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: tomcat5-0:5.0.30-0jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: jabberd-0:2.0s10-3.38.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: jfreechart-0:0.9.20-3.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: openmotif21-0:2.1.30-11.RHEL4.6

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: perl-Crypt-CBC-0:2.24-1.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-modjk-0:1.2.23-2rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-modperl-0:1.29-16.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-modssl-0:2.8.12-8.rhn.10.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: tomcat5-0:5.0.30-0jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: httpd-0:2.0.59-1.el4s1.7

Vendor Advisories (1)

redhatCVE-2006-5752Moderate

httpd mod_status XSS

References

bugs.gentoo.org / show_bug.cgi

Issue TrackingThird Party Advisory

bugzilla.redhat.com / bugzilla/show_bug.cgi

Issue TrackingThird Party Advisory

h20000.www2.hp.com / bizsupport/TechSupport/Document.jsp

Third Party Advisory

httpd.apache.org / security/vulnerabilities_13.html

Vendor Advisory

httpd.apache.org / security/vulnerabilities_20.html

Vendor Advisory

httpd.apache.org / security/vulnerabilities_22.html

Vendor Advisory

lists.vmware.com / pipermail/security-announce/2009/000062.html

Mailing ListThird Party Advisory

osvdb.org / 37052

Broken Link

rhn.redhat.com / errata/RHSA-2007-0534.html

Third Party Advisory

rhn.redhat.com / errata/RHSA-2007-0556.html

Third Party Advisory

secunia.com / advisories/25827

Not Applicable

secunia.com / advisories/25830

Not Applicable

secunia.com / advisories/25873

Not Applicable

secunia.com / advisories/25920

Not Applicable

secunia.com / advisories/26273

Not Applicable

secunia.com / advisories/26443

Not Applicable

secunia.com / advisories/26458

Not Applicable

secunia.com / advisories/26508

Not Applicable

secunia.com / advisories/26822

Not Applicable

secunia.com / advisories/26842

Not Applicable

secunia.com / advisories/26993

Not Applicable

secunia.com / advisories/27037

Not Applicable

secunia.com / advisories/27563

Not Applicable

secunia.com / advisories/27732

Not Applicable

secunia.com / advisories/28212

Not Applicable

secunia.com / advisories/28224

Not Applicable

secunia.com / advisories/28606

Not Applicable

security.gentoo.org / glsa/glsa-200711-06.xml

Third Party Advisory

exchange.xforce.ibmcloud.com / vulnerabilities/35097

Third Party AdvisoryVDB Entry

issues.rpath.com / browse/RPL-1500

Broken Link

lists.apache.org / thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10154

Third Party Advisory

rhn.redhat.com / errata/RHSA-2007-0533.html

Third Party Advisory

sunsolve.sun.com / search/document.do

Broken Link

sunsolve.sun.com / search/document.do

Broken Link

support.avaya.com / elmodocs2/security/ASA-2007-353.htm

Third Party Advisory

svn.apache.org / viewvc

Vendor Advisory

www-1.ibm.com / support/docview.wss

Third Party Advisory

www-1.ibm.com / support/search.wss

Third Party Advisory

fujitsu.com / global/support/software/security/products-f/interstage-200802e.html

Third Party Advisory

mandriva.com / security/advisories

Broken Link

mandriva.com / security/advisories

Broken Link

mandriva.com / security/advisories

Broken Link

novell.com / linux/security/advisories/2007_61_apache2.html

Broken Link

oracle.com / technetwork/topics/security/cpujuly2013-1899826.html

Third Party Advisory

redhat.com / archives/fedora-package-announce/2007-September/msg00320.html

Mailing ListThird Party Advisory

redhat.com / support/errata/RHSA-2007-0532.html

Third Party Advisory

redhat.com / support/errata/RHSA-2007-0557.html

Third Party Advisory

redhat.com / support/errata/RHSA-2008-0261.html

Third Party Advisory

securityfocus.com / archive/1/505990/100/0/threaded

Third Party AdvisoryVDB Entry

securityfocus.com / bid/24645

PatchThird Party AdvisoryVDB Entry

securitytracker.com / id

Broken LinkThird Party AdvisoryVDB Entry

trustix.org / errata/2007/0026

Broken Link

ubuntu.com / usn/usn-499-1

Third Party Advisory

vupen.com / english/advisories/2007/2727

Permissions Required

vupen.com / english/advisories/2007/3283

Permissions Required

vupen.com / english/advisories/2007/3386

Permissions Required

vupen.com / english/advisories/2007/4305

Permissions Required

vupen.com / english/advisories/2008/0233

Permissions Required