Unscored severity · published Jan 25, 2008
CVE-2008-0455
Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and…
–
CVSS
64.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
Exploitation
Is it being used?
Exploit prediction (EPSS)64.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HS
HTTP Server · Apache
2.2.0 before 2.2.23; 2.4.1 before 2.4.3 · source: NVD
EL
Enterprise Linux Desktop · Redhat
5.0 · source: NVD
EL
Enterprise Linux Server · Redhat
5.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
5.0 · source: NVD
JE
Jboss Enterprise Application Platform · Redhat
6.0.0; 6.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-0455
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-0455
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1591.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1592.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1594.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0130.html
Not Applicable
http://secunia.com/advisories/29348
Not Applicable
http://secunia.com/advisories/51607
More from HTTP Server
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
9.8
CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
9.1
CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
9.0
CVE-2021-40438
mod_proxy SSRF
7.8
CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability