p PatchFirst

CVE-2008-0455

CVE-2008-0455

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.

EPSS 64.8% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • apache2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.2.22-8

    Update to 2.2.22-8

  • apache2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.2.22-8

    Update to 2.2.22-8

  • apache2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.2.22-8

    Update to 2.2.22-8

Original sources

Check your server →