How severe is CVE-2004-2171?

CVE-2004-2171 has a CVSS 2.0 base score of 4.3, rated medium severity.

Is CVE-2004-2171 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (88th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2004-2171?

CVE-2004-2171 primarily affects Cherokee Cherokee Httpd. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2004-2171?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2004-2171 published?

CVE-2004-2171 was published on 2004-12-31 and last updated on 2026-06-16.

CVE-2004-2171

CVE-2004-2171 is a medium-severity vulnerability in Cherokee Cherokee Httpd with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 4.3)
EPSS exploit prediction: 4% (88th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Cherokee Cherokee Httpd
Published: 2004-12-31
Last modified: 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting error page.

Frequently asked questions

What is CVE-2004-2171?: Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting error page.
How severe is CVE-2004-2171?: CVE-2004-2171 has a CVSS 2.0 base score of 4.3, rated medium severity.
Is CVE-2004-2171 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (88th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2004-2171?: CVE-2004-2171 primarily affects Cherokee Cherokee Httpd. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2004-2171?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2004-2171 published?: CVE-2004-2171 was published on 2004-12-31 and last updated on 2026-06-16.

References

Affected products (9)

cpe:2.3:a:cherokee:cherokee_httpd:0.1:*:*:*:*:*:*:*
cpe:2.3:a:cherokee:cherokee_httpd:0.1.5:*:*:*:*:*:*:*
cpe:2.3:a:cherokee:cherokee_httpd:0.1.6:*:*:*:*:*:*:*
cpe:2.3:a:cherokee:cherokee_httpd:0.2:*:*:*:*:*:*:*
cpe:2.3:a:cherokee:cherokee_httpd:0.2.5:*:*:*:*:*:*:*
cpe:2.3:a:cherokee:cherokee_httpd:0.2.6:*:*:*:*:*:*:*
cpe:2.3:a:cherokee:cherokee_httpd:0.2.7:*:*:*:*:*:*:*
cpe:2.3:a:cherokee:cherokee_httpd:0.4.6:*:*:*:*:*:*:*
cpe:2.3:a:cherokee:cherokee_httpd:0.4.7:*:*:*:*:*:*:*

More vulnerabilities in Cherokee Cherokee Httpd

CVE-2004-1097 — Critical (CVSS 10.0): Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when…
CVE-2001-1432 — High (CVSS 7.8): Directory traversal vulnerability in Cherokee Web Server allows remote attackers to read arbitrary files via a .. (dot…
CVE-2001-1433 — High (CVSS 7.5): Cherokee web server before 0.2.7 does not properly drop root privileges after binding to port 80, which could allow…
CVE-2009-3902 — Medium (CVSS 5.0): Directory traversal vulnerability in Cherokee Web Server 0.5.4 and earlier for Windows allows remote attackers to read…
CVE-2003-1198 — Medium (CVSS 5.0): connection.c in Cherokee web server before 0.4.6 allows remote attackers to cause a denial of service via an HTTP POST…
CVE-2004-1946 — Medium (CVSS 4.6): Format string vulnerability in the PRINT_ERROR function in common.c for Cherokee Web Server 0.4.16 and earlier allows…

All CVEs affecting Cherokee Cherokee Httpd →