4.3

CVE-2008-0455: apache http_server

Modified
AliasesDEBIAN-CVE-2008-0455
Published 25-01-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-0455 is a medium (CVSS 4.3) vulnerability in apache http_server. EPSS estimates a 64.77% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities. 5 public exploits are recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 22-01-2008)

Source freshness unavailable

How is this decided?
CVSS score
4.3/10
010
Medium · v2.0 (NVD)
EPSS score
64.77%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits5reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 4
RHSA-2012:1591RHSA-2012:1592RHSA-2013:0130RHSA-2013:0512

Timeline

  1. 25-01-2008
    PublishedVulnerability first disclosed.
  2. 07-08-2024
    Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

64.77%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 64.77% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

5 found
  • referenceUnverified

    Exploit Reference (securitytracker.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (securityreason.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (mindedsecurity.com)

    Maturity: unknown

Show all 5 exploits
  • referenceUnverified

    Exploit Reference (securityfocus.com)

    Maturity: unknown

  • exploit-databaseremotelinuxVerified

    Apache 2.2.6 mod_negotiation - HTML Injection / HTTP Response Splitting

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat4 products
Apache1 product
Debian1 product
  • apache2< 2.2.22-8

3 vendors · 6 products

References

27 links
Show all 27 references