PT-2008-2087 · Apache+2 · Apache Http Server+2
Niels Heinen
·
Published
2008-01-25
·
Updated
2022-09-21
·
CVE-2008-0455
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Apache HTTP Server versions 1.3.39 and earlier, 2.0.61 and earlier, 2.2.6 and earlier
Description
A cross-site scripting (XSS) issue exists in the mod negotiation module, allowing remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension. This leads to injection within a "406 Not Acceptable" or "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
Recommendations
For Apache HTTP Server versions 1.3.39 and earlier, 2.0.61 and earlier, 2.2.6 and earlier, consider disabling the mod negotiation module until a patch is available to prevent exploitation of this issue. Restrict access to file uploads to minimize the risk of arbitrary web script or HTML injection. Avoid using file extensions in requests for files uploaded with potentially malicious names.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Http Server
Centos
Red Hat