CVE-2000-1205

Apache Http — CWE-79

EPSS 5.7%
  • Published: 2000-02-01T05:00:00.000
  • Last modified: 2025-04-03T01:03:51.193
  • Vendors: Apache
  • Products: Http
  • CWE: CWE-79

Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache modules or core code. NOTE: the printenv issue might still exist for web browsers that can render text/plain content types as HTML, such as Internet Explorer, but CVE regards this as a design limitation of those browsers, not Apache. The printenv.pl/acuparam vector, discloser on 20070724, is one such variant.

Related CVE by CWE

No related CWE found.

Top CVE for Vendor

  1. CVE-1999-0236 (CVSS 7.5)
  2. CVE-1999-0678 (no score)
  3. CVE-1999-1412 (no score)
  4. CVE-1999-1237 (no score)
  5. CVE-2000-1206 (no score)
  6. CVE-1999-0067 (no score)
  7. CVE-1999-0926 (no score)
  8. CVE-1999-0070 (no score)
  9. CVE-1999-1053 (no score)
  10. CVE-1999-0045 (no score)

Recently Exploited Similar Vulnerabilities

No recent KEV-listed items for this vendor/product.

How to fix CVE-2000-1205

CVE-2000-1205 is a unknown severity vulnerability affecting Apache Http.

Description: Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages […]

Exploit Difficulty: HARD
⏱️ Time to exploit: > 4 hours
🛠️ Required skills: Advanced security expertise
💰 Public exploits: Rare or not public

How to Fix:

1 Identify affected systems

- Check if you're running Http

2 Immediate actions

- Update to the latest patched version
- If patching is not immediately possible: restrict network exposure, apply least-privilege access

3 Verification

- Test the fix in a staging environment first
- Review logs for signs of exploitation
- Monitor for IOCs (Indicators of Compromise)

4 Long-term prevention

- Enable automatic security updates
- Set up vulnerability monitoring
- Review and harden security configurations
CWE: CWE-79

Exploit Difficulty Assessment

HARD
⏱️ Time to Exploit: > 4 hours
🛠️ Skills Required: Advanced security expertise
💰 Public Exploits: Rare or not public

Vulnerability Timeline

Feb 01, 2000
Vulnerability Published

CVE details first published to NVD database

Apr 03, 2025
Last Modified

CVE details were updated

Nov 03, 2025
Imported to Database

Added to this CVE tracking system

Detection Rules & IOCs

No specific detection rules generated for this vulnerability type.

Apache Http