Evil-DB LogoEvil-DB
← All CVEs

CVE-2008-2168

medium · 4.3

Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.

4.3
CVSS
54.9%
EPSS (exploit prob.)
99th
EPSS percentile
2008-05-13
Published

AV:N/AC:M/Au:N/C:N/I:P/A:N

Weaknesses

CWE-79

Affected products

VendorProductAffected versions
apachehttp_serverall versions
apachehttp_server2.0
apachehttp_server2.0.9
apachehttp_server2.0.28
apachehttp_server2.0.28
apachehttp_server2.0.32
apachehttp_server2.0.32
apachehttp_server2.0.34
apachehttp_server2.0.35
apachehttp_server2.0.36
apachehttp_server2.0.37
apachehttp_server2.0.38
apachehttp_server2.0.39
apachehttp_server2.0.40
apachehttp_server2.0.41
apachehttp_server2.0.42
apachehttp_server2.0.43
apachehttp_server2.0.44
apachehttp_server2.0.45
apachehttp_server2.0.46
apachehttp_server2.0.47
apachehttp_server2.0.48
apachehttp_server2.0.49
apachehttp_server2.0.50
apachehttp_server2.0.51
apachehttp_server2.0.52
apachehttp_server2.0.53
apachehttp_server2.0.54
apachehttp_server2.0.55
apachehttp_server2.0.56
apachehttp_server2.0.57
apachehttp_server2.0.58
apachehttp_server2.0.59
apachehttp_server2.0.60
apachehttp_server2.0.61
apachehttp_server2.1
apachehttp_server2.1.1
apachehttp_server2.1.2
apachehttp_server2.1.3
apachehttp_server2.1.4

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2008-2168