CVE-2008-0455

published 2008-01-25

CVE-2008-0455: Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in…

Priority P4 33 medium 4.3 CVSS 2.0

AV N AC M Au N C N I P A N

EXPLOIT

Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
apache	http_server	>= 2.2.0 < 2.2.23	2.2.23
apache	http_server	>= 2.4.1 < 2.4.3	2.4.3
debian	apache2	< apache2 2.2.22-8 (bookworm)	apache2 2.2.22-8 (bookworm)
redhat	enterprise_linux_desktop	—	—
redhat	enterprise_linux_server	—	—
redhat	enterprise_linux_workstation	—	—
redhat	jboss_enterprise_application_platform	—	—
redhat	jboss_enterprise_application_platform	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://victim/#alert(123)↗

other Accept: image/jpeg; q=0↗

• → Look for HTTP responses with status '406 Not Acceptable' or '300 Multiple Choices' that contain unsanitized filenames with XSS sequences (e.g., script tags or JavaScript URIs) in the response body — these are generated by mod_negotiation when a file with an XSS-laden name exists and the extension is omitted in the request. ↗
• → Monitor for POST requests with an 'Accept' header set to 'image/jpeg; q=0' (quality factor zero) targeting paths with fragment identifiers containing JavaScript payloads — this is the PoC exploit delivery pattern. ↗
• → Detect exploitation preconditions: directories with MultiViews enabled in Apache httpd where untrusted users can upload or create arbitrarily named files. Audit httpd.conf for 'MultiViews' in Options directives combined with writable directories. ↗
• → Alert on filenames containing XSS sequences (e.g., '<script>', 'javascript:', '%3Cscript%3E') being uploaded or created in web-accessible directories served by Apache with mod_negotiation enabled. ↗

• · Vulnerability only triggers when mod_negotiation is loaded AND MultiViews is enabled for the directory AND attackers can upload/create arbitrarily named files in that directory. Default configurations are not affected. ↗
• · CVE-2012-2687 is a duplicate of CVE-2008-0455 — the XSS issue was re-discovered and assigned a new CVE years later. Detection rules should cover both CVE identifiers. ↗
• · Disabling MultiViews (adding '-MultiViews' to Options in httpd.conf) or disabling mod_negotiation entirely are the recommended mitigations; removing MultiViews is described as the least impactful workaround. ↗

CVSS provenance

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

osv 4.3 MEDIUM

vendor_debian 4.3 LOW

vendor_redhat 4.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79