Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2008-0455

Published: 25/01/2008 Updated: 07/11/2023
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 435
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Subscribe to Apache

Vulnerability Summary

Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and previous versions in the 2.2.x series, 2.0.61 and previous versions in the 2.0.x series, and 1.3.39 and previous versions in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache http server

redhat enterprise linux server 5.0

redhat enterprise linux workstation 5.0

redhat enterprise linux desktop 5.0

redhat jboss_enterprise_application_platform 6.0.0

redhat jboss_enterprise_application_platform 6.4.0

Vendor Advisories

Red Hat: Important: JBoss Enterprise Application Platform 6.0.1 update
Synopsis Important: JBoss Enterprise Application Platform 601 update Type/Severity Security Advisory: Important Topic JBoss Enterprise Application Platform 601, which fixes multiple securityissues, various bugs, and adds enhancements, is now available from the RedHat Customer PortalThe Red Hat Security ...
Red Hat: Low: httpd security, bug fix, and enhancement update
Synopsis Low: httpd security, bug fix, and enhancement update Type/Severity Security Advisory: Low Topic Updated httpd packages that fix multiple security issues, various bugs,and add enhancements are now available for Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as ha ...
Red Hat: Important: JBoss Enterprise Application Platform 6.0.1 update
Synopsis Important: JBoss Enterprise Application Platform 601 update Type/Severity Security Advisory: Important Topic Updated JBoss Enterprise Application Platform 601 packages that fixmultiple security issues, various bugs, and add enhancements are nowavailable for Red Hat Enterprise Linux 5The Red Ha ...
Red Hat: Important: JBoss Enterprise Application Platform 6.0.1 update
Synopsis Important: JBoss Enterprise Application Platform 601 update Type/Severity Security Advisory: Important Topic Updated JBoss Enterprise Application Platform 601 packages that fixmultiple security issues, various bugs, and add enhancements are nowavailable for Red Hat Enterprise Linux 6The Red Ha ...
Red Hat: Low: httpd security, bug fix, and enhancement update
Synopsis Low: httpd security, bug fix, and enhancement update Type/Severity Security Advisory: Low Topic Updated httpd packages that fix two security issues, several bugs, and addvarious enhancements are now available for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as ...

Exploits

Exploit DB: Apache 2.2.6 mod_negotiation - HTML Injection / HTTP Response Splitting
source: wwwsecurityfocuscom/bid/27409/info Apache 'mod_negotiation' is prone to an HTML-injection and an HTTP response-splitting vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content Attacker-supplied HTML or JavaScript code could run in the context of the a ...

References

CWE-79http://www.mindedsecurity.com/MSA01150108.htmlhttp://www.securityfocus.com/bid/27409http://securitytracker.com/id?1019256http://security.gentoo.org/glsa/glsa-200803-19.xmlhttp://secunia.com/advisories/29348http://securityreason.com/securityalert/3575http://rhn.redhat.com/errata/RHSA-2012-1592.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1591.htmlhttp://secunia.com/advisories/51607http://rhn.redhat.com/errata/RHSA-2012-1594.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0130.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/39867http://www.securityfocus.com/archive/1/486847/100/0/threadedhttps://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://nvd.nist.govhttps://access.redhat.com/errata/RHSA-2012:1594https://www.exploit-db.com/exploits/31052/
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-47626CVE-2024-3400physicalCVE-2024-31426CVE-2024-22423CVE-2024-22438injectlocal usersCVE-2024-3797
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook