CVE-2008-2168
NoneCVSS
—
EPSS
54.9%
Published
May 13, 2008
CISA due date
—
The record
Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | apache2 | 0 | 0 |
| Chainguard | apache2-compat | 0 | 0 |
| Chainguard | apache2-config | 0 | 0 |
| Chainguard | apache2-config-compat | 0 | 0 |
| Chainguard | apache2-data | 0 | 0 |
| Chainguard | apache2-dev | 0 | 0 |
| Chainguard | apache2-doc | 0 | 0 |
| Chainguard | apache2-oci-entrypoint | 0 | 0 |
| Chainguard | apache2-utils | 0 | 0 |
| Debian:10 | apache2 | 0 | 2.2.8-1 |
| Debian:11 | apache2 | 0 | 2.2.8-1 |
| Debian:12 | apache2 | 0 | 2.2.8-1 |
| Debian:13 | apache2 | 0 | 2.2.8-1 |
| Wolfi | apache2 | 0 | 0 |
| Wolfi | apache2-compat | 0 | 0 |
| Wolfi | apache2-config | 0 | 0 |
| Wolfi | apache2-config-compat | 0 | 0 |
| Wolfi | apache2-data | 0 | 0 |
| Wolfi | apache2-dev | 0 | 0 |
| Wolfi | apache2-doc | 0 | 0 |
| Wolfi | apache2-oci-entrypoint | 0 | 0 |
| Wolfi | apache2-utils | 0 | 0 |
Related vulnerabilities
- CVE-2007-0450 Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and… Also affects apache2
- CVE-2007-0086 The Apache HTTP Server, when accessed through a TCP connection with a large window size… Also affects apache2
- CVE-1999-1412 A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows… Also affects apache2
- CVE-1999-0678 A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc… Also affects apache2
- CVE-1999-0236 ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs. Also affects apache2
- CVE-2015-0228 The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP… Also affects apache2
- CVE-2014-3583 The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the… Also affects apache2
- CVE-2013-4352 The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in… Also affects apache2