NetSight
IP …
medium4.3Public exploit code

CVE-2008-0455

Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in t…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.

Affected products

VendorProductAffected versions
ApacheHttp Server
from 2.2.0 before 2.2.23
from 2.4.1 before 2.4.3
RedhatEnterprise Linux Desktop
Version 5.0
RedhatEnterprise Linux Server
Version 5.0
RedhatEnterprise Linux Workstation
Version 5.0
RedhatJboss Enterprise Application Platform
Versions 6.0.0, 6.4.0

Weakness classification

CWE-79

References