VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 13, 2005· Updated Apr 16, 2026

CVE-2005-3352

CVE-2005-3352

Description

Cross-site scripting in Apache mod_imap allows attackers to inject arbitrary script via the Referer header when using image maps.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Cross-site scripting in Apache mod_imap allows attackers to inject arbitrary script via the Referer header when using image maps.

Vulnerability

Cross-site scripting (XSS) vulnerability exists in the mod_imap module of Apache HTTP Server. The module fails to escape the Referer header when generating HTML for image maps, allowing injection of arbitrary HTML or script. Affected versions: Apache 1.3.x before 1.3.35-dev and Apache 2.0.x before 2.0.56-dev [1][3][4].

Exploitation

An attacker can craft a malicious Referer header containing JavaScript. When a victim visits a page on a vulnerable server that uses image maps, the server reflects the unescaped Referer in the response, causing the script to execute in the victim's browser. No authentication is required; the attacker only needs to lure the victim to a crafted link or page that sets the Referer header.

Impact

Successful exploitation allows arbitrary script execution in the context of the vulnerable site. This can lead to session hijacking, cookie theft, defacement, or redirection to malicious sites. The attack is limited to the browser's same-origin policy, but can compromise user data on the affected domain.

Mitigation

Upgrade to Apache HTTP Server 1.3.35 or 2.0.56, which properly escape the Referer header using ap_escape_html [3][4]. Red Hat released updated packages in RHSA-2006-0158 (for Apache 1.3) and RHSA-2006-0159 (for Apache 2.0) [1][4]. Slackware also provided updated packages for multiple versions [3]. No workaround is documented; applying the patch is recommended.

References
  1. http://rhn.redhat.com/errata/RHSA-2006-0159.html
  2. The Slackware Linux Project: Slackware Security Advisories
  3. Support

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

4

Patches

1
90521799bdb9
https://github.com/apache/httpdvia github-commit-search
commit

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

81

News mentions

0

No linked articles in our index yet.