Skip to content
Fencer Vulns
medium 4.3

CVE-2008-0455 json

Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0…

published 2008-01-25 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-0465

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
64.9%
EPSS 64.9% chance of exploitation in 30 days, percentile 99.2%
public exploits
1
Exploit-DB

Summary

Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.

Patch / fix

  • apache http_server 2.2.23, 2.4.3
  • apache2 Debian 14, Debian 13, Debian 12 2.2.22-8

debian advisories DEBIAN-CVE-2008-0455

  • xom jboss enterprise application platform 6 1.2.7-1._redhat_3.1.ep6.el6.6
  • dom4j jboss enterprise application platform 6 1.6.1-14_redhat_3.ep6.el6
  • guava jboss enterprise application platform 6 11.0.2-0.5.redhat_2.ep6.el6.6
  • httpd jboss enterprise application platform 6 2.2.22-14.ep6.el6
  • jaxen jboss enterprise application platform 6 1.1.3-8.redhat_2.ep6.el6.4
  • jtype jboss enterprise application platform 6 0.1.1-9_redhat_2.3.ep6.el6.4
  • juddi jboss enterprise application platform 6 3.1.3-2_redhat_2.1.ep6.el6.3
  • netty jboss enterprise application platform 6 3.2.6-2_redhat_2.2.ep6.el6.4

red hat advisories RHSA-2012:1592RHSA-2012:1591RHSA-2013:0130RHSA-2013:0512

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2008-0455 updated cvss 2.6

httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled

  • Red Hat JBoss Enterprise Web Server 1 httpd
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux (v. 5 server) httpd 2.2.3-74.el5, mod_ssl 2.2.3-74.el5, httpd-manual 2.2.3-74.el5 Red Hat Enterprise Linux Desktop (v. 5 client) httpd 2.2.3-74.el5, mod_ssl 2.2.3-74.el5
    fixed: vendor fix RHSA-2013:0130
  • Red Hat Enterprise Linux Desktop (v. 6) httpd 2.2.15-26.el6, httpd-tools 2.2.15-26.el6 Red Hat Enterprise Linux Desktop Optional (v. 6) httpd 2.2.15-26.el6, mod_ssl 2.2.15-26.el6, httpd-manual 2.2.15-26.el6
    fixed: vendor fix RHSA-2013:0512
  • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) httpd 2.2.3-74.el5, httpd-manual 2.2.3-74.el5
    fixed: vendor fix RHSA-2013:0130
  • Red Hat Enterprise Linux HPC Node (v. 6) httpd 2.2.15-26.el6, httpd-tools 2.2.15-26.el6 Red Hat Enterprise Linux HPC Node Optional (v. 6) httpd 2.2.15-26.el6, mod_ssl 2.2.15-26.el6, httpd-manual 2.2.15-26.el6 Red Hat Enterprise Linux Server (v. 6) httpd 2.2.15-26.el6, mod_ssl 2.2.15-26.el6, httpd-tools 2.2.15-26.el6, httpd-manual 2.2.15-26.el6 Red Hat Enterprise Linux Workstation (v. 6) httpd 2.2.15-26.el6, mod_ssl 2.2.15-26.el6, httpd-tools 2.2.15-26.el6, httpd-manual 2.2.15-26.el6
    fixed: vendor fix RHSA-2013:0512
  • Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server httpd 2.2.22-14.ep6.el5, mod_jk 1.2.36-5.1.ep6.el5, mod_ssl 2.2.22-14.ep6.el5, httpd-tools 2.2.22-14.ep6.el5, mod_jk-ap22 1.2.36-5.1.ep6.el5, wss4j 1.6.7-1.redhat_1.ep6.el5, +255 more
    fixed: vendor fix RHSA-2012:1591
  • Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server httpd 2.2.22-14.ep6.el6, mod_jk 1.2.36-5.ep6.el6, mod_ssl 2.2.22-14.ep6.el6, mod_jk-ap22 1.2.36-5.ep6.el6, httpd-tools 2.2.22-14.ep6.el6, tomcat-native 1.1.24-1.ep6.el6, +252 more
    fixed: vendor fix RHSA-2012:1592
  • Red Hat JBoss Enterprise Application Platform 6.0
    fixed: vendor fix RHSA-2012:1594

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-31052)
  2. Published

Exploit prediction

64.90% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-31052 Apache 2.2.6 mod_negotiation - HTML Injection / HTTP Response Splitting remote, 2008-01-22
  • securitytracker.com http://securitytracker.com/id?1019256 referenced PoC, tagged "exploit" by a source, unverified
  • securityreason.com http://securityreason.com/securityalert/3575 referenced PoC, tagged "exploit" by a source, unverified
  • mindedsecurity.com http://www.mindedsecurity.com/MSA01150108.html referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/bid/27409 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.