CVE-1999-1053

guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary…

published September 12, 2001

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.7th percentile for exploit probability.

CVSS
—
EPSS
85%
Percentile
99.7
In the wild
Unconfirmed
What it is

guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.85205 · 99.7th percentile
Published
2001-09-12T04:00Z
EPSS history
Timeline
  • 12 SEP 04:00Z
    guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary…
    cvelistv5