New Apache Cross site scripting vulnerability
 

Input passed in the URL isn't properly sanitized before being used by the Web-Access-Log viewer. This can be exploited to execute arbitrary JavaScript code in user's browser session in context of an affected website when a malicious log entry is viewed in Geronimo-admin.
http://issues.apache.org/jira/browse/GERONIMO-1474

Thread title is a little misleading....
 

This is a vulnerability for Geronimo (another project by the Apache team), not the Apache httpd server. |huh

http://geronimo.apache.org/

http://httpd.apache.org