CVE-2008-2939

Apache HTTP Server < 2.0.63 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.

References (62)

[Mailing List] http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

[Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html

[Third Party Advisory] http://marc.info/?l=bugtraq&m=123376588623823&w=2

[Third Party Advisory] http://marc.info/?l=bugtraq&m=125631037611762&w=2

[Third Party Advisory] http://rhn.redhat.com/errata/RHSA-2008-0967.html

[Broken Link] http://secunia.com/advisories/31384

[Broken Link] http://secunia.com/advisories/31673

[Broken Link] http://secunia.com/advisories/32685

[Broken Link] http://secunia.com/advisories/32838

[Broken Link] http://secunia.com/advisories/33156

[Broken Link] http://secunia.com/advisories/33797

[Broken Link] http://secunia.com/advisories/34219

[Broken Link] http://secunia.com/advisories/35074

[Broken Link] http://sunsolve.sun.com/search/document.do?assetkey=1-26-247666-1

[Third Party Advisory] http://support.apple.com/kb/HT3549

[Third Party Advisory] http://svn.apache.org/viewvc?view=rev&revision=682868

[Third Party Advisory] http://svn.apache.org/viewvc?view=rev&revision=682870

[Third Party Advisory] http://svn.apache.org/viewvc?view=rev&revision=682871

[Broken Link] http://wiki.rpath.com/Advisories:rPSA-2008-0327

[Broken Link] http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0328

... and 42 more

Scores

EPSS 0.7125

EPSS Percentile 98.7%

Classification

CWE

CWE-79

Status draft

Affected Products (8)

apache/http_server < 2.0.63

apple/mac_os_x < 10.5.6

canonical/ubuntu_linux

canonical/ubuntu_linux

canonical/ubuntu_linux

opensuse/opensuse

opensuse/opensuse

opensuse/opensuse

Timeline

Published Aug 06, 2008

Tracked Since Feb 18, 2026