4.3

CVE-2008-2168: apache http_server

Modified
AliasesDEBIAN-CVE-2008-2168CGA-4w36-5q9x-r8jpCGA-jm8v-gvcr-6qcw
Published 13-05-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-2168 is a medium (CVSS 4.3) vulnerability in apache http_server. EPSS estimates a 54.85% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities. 2 public exploits are recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 08-05-2008)

Source freshness unavailable

How is this decided?
CVSS score
4.3/10
010
Medium · v2.0 (NVD)
EPSS score
54.85%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-3HMX-MWP6-3GJ6

Timeline

  1. 13-05-2008
    PublishedVulnerability first disclosed.
  2. 07-08-2024
    Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

54.85%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 54.85% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (securityfocus.com)

    Maturity: unknown

  • exploit-databaseremotewindowsVerified

    Microsoft Internet Explorer 2 - UTF-7 HTTP Response Handling

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Apache1 product
  • http_serverEOLna | 2.0 | 2.0.9 | 2.0.28 | 2.0.28:beta | 2.0.32 | 2.0.32:beta | 2.0.34:beta | 2.0.35 | 2.0.36 | 2.0.37 | 2.0.38 | 2.0.39 | 2.0.40 | 2.0.41 | 2.0.42 | 2.0.43 | 2.0.44 | 2.0.45 | 2.0.46 | 2.0.47 | 2.0.48 | 2.0.49 | 2.0.50 | 2.0.51 | 2.0.52 | 2.0.53 | 2.0.54 | 2.0.55 | 2.0.56 | 2.0.57 | 2.0.58 | 2.0.59 | 2.0.60 | 2.0.61 | 2.1 | 2.1.1 | 2.1.2 | 2.1.3 | 2.1.4 | 2.1.5 | 2.1.6 | 2.1.7 | 2.1.8 | 2.2 | 2.2.1 | 2.2.2 | 2.2.3 | 2.2.4
Chainguard1 product
  • apache2All versions (No fix recorded)
Debian1 product
  • apache2< 2.2.8-1
Wolfi1 product
  • apache2All versions (No fix recorded)

4 vendors · 4 products

References

16 links
Show all 16 references