Description

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Remediation

References

CVE-2013-6438

Related Vulnerabilities

MediaWiki CVE-2023-45362 Vulnerability (CVE-2023-45362)

WordPress Plugin 404 to 301-Redirect, Log and Notify 404 Errors Security Bypass (3.0.1)

Perl Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2017-12837)

WordPress Plugin Calendar Event Multi View Multiple Vulnerabilities (1.1.4)

Atlassian Jira Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2021-43944)

Severity

Medium

Classification

CVE-2013-6438

Tags

Missing Update Known Vulnerabilities