CVE-2007-4465

27

FAUCET Score

CVE-2007-4465 describes a cross-site scripting (XSS) vulnerability in Apache HTTP Server versions prior to 2.2.6, specifically within mod_autoindex.c. This flaw allows remote attackers to inject arbitrary web script or HTML via the P parameter, leveraging the UTF-7 charset when a server-generated page lacks a defined charset. With a CVSS score of 6.1 (MEDIUM), this vulnerability has a network attack vector and low attack complexity, requiring user interaction, potentially leading to low impacts on confidentiality and integrity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.0.0, < 2.0.61CPE matchmatch criteria	cpe:2.3:a:apache:http_server::::::::
		>= 2.2.0, < 2.2.6CPE matchmatch criteria	cpe:2.3:a:apache:http_server::::::::

CVSS Data

CVSS version used by this source: 2.0

4.3MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Exploitability Score

8.6

Impact Score

2.9

CvssVersion

2.0

Exploit Intelligence

EPSS Score

26.19%

Probability of exploitation in next 30 days

EPSS Percentile

97.8%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.2619 is in the 99th percentile among its peer group of 26,234 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (61)

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: ant-0:1.6.5-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: avalon-logkit-0:1.2-2jpp_4rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: axis-0:1.2.1-1jpp_3rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: classpathx-jaf-0:1.0-2jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: classpathx-mail-0:1.1.1-2jpp_8rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: geronimo-specs-0:1.0-0.M4.1jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: jakarta-commons-modeler-0:2.0-3jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: log4j-0:1.2.12-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: mx4j-1:3.0.1-1jpp_4rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: pcsc-lite-0:1.3.3-3.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-ca-0:7.3.0-20.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-java-tools-0:7.3.0-10.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-kra-0:7.3.0-14.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-manage-0:7.3.0-19.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-native-tools-0:7.3.0-6.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-ocsp-0:7.3.0-13.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-tks-0:7.3.0-13.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: tomcat5-0:5.5.23-0jpp_4rh.16

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: xerces-j2-0:2.7.1-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: xml-commons-0:1.3.02-2jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 2.1Fixed in: apache-0:1.3.27-14.ent

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 3Fixed in: httpd-0:2.0.46-70.ent

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 4Fixed in: httpd-0:2.0.52-38.ent.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: httpd-0:2.2.3-11.el5_1.3

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 3)Fixed in: jabberd-0:2.0s10-3.37.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 3)Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 3)Fixed in: rhn-modperl-0:1.29-16.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 4)Fixed in: jabberd-0:2.0s10-3.38.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 4)Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 4)Fixed in: rhn-modperl-0:1.29-16.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: jabberd-0:2.0s10-3.38.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: jfreechart-0:0.9.20-3.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: openmotif21-0:2.1.30-11.RHEL4.6

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: perl-Crypt-CBC-0:2.24-1.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-modjk-0:1.2.23-2rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-modperl-0:1.29-16.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-modssl-0:2.8.12-8.rhn.10.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: tomcat5-0:5.0.30-0jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: jabberd-0:2.0s10-3.37.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: jfreechart-0:0.9.20-3.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: openmotif21-0:2.1.30-9.RHEL3.8

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: perl-Crypt-CBC-0:2.24-1.el3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-modjk-0:1.2.23-2rhn.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-modperl-0:1.29-16.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-modssl-0:2.8.12-8.rhn.10.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: tomcat5-0:5.0.30-0jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: jabberd-0:2.0s10-3.38.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: jfreechart-0:0.9.20-3.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: openmotif21-0:2.1.30-11.RHEL4.6

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: perl-Crypt-CBC-0:2.24-1.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-modjk-0:1.2.23-2rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-modperl-0:1.29-16.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-modssl-0:2.8.12-8.rhn.10.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: tomcat5-0:5.0.30-0jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: httpd-0:2.0.59-1.el4s1.8

Vendor Advisories (1)

redhatCVE-2007-4465Low

mod_autoindex XSS

References

bugs.gentoo.org / show_bug.cgi

Third Party Advisory

h20000.www2.hp.com / bizsupport/TechSupport/Document.jsp

Broken Link

lists.apple.com / archives/security-announce/2008//May/msg00001.html

Mailing List

Third Party AdvisoryVDB Entry

Mailing ListThird Party Advisory

secunia.com / advisories/26842

Broken Link

secunia.com / advisories/26952

Broken Link

secunia.com / advisories/27563

Broken Link

secunia.com / advisories/27732

Broken Link

secunia.com / advisories/28467

Broken Link

secunia.com / advisories/28471

Broken Link

secunia.com / advisories/28607

Broken Link

secunia.com / advisories/28749

Broken Link

secunia.com / advisories/30430

Broken Link

secunia.com / advisories/31651

Broken Link

secunia.com / advisories/33105

Broken Link

secunia.com / advisories/35650

Broken Link

security.gentoo.org / glsa/glsa-200711-06.xml

Third Party Advisory

securityreason.com / achievement_securityalert/46

Third Party Advisory

securityreason.com / securityalert/3113

Third Party Advisory

securitytracker.com / id

Third Party AdvisoryVDB Entry

exchange.xforce.ibmcloud.com / vulnerabilities/36586

Third Party AdvisoryVDB Entry

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10929

Broken Link

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6089

Broken Link

support.avaya.com / elmodocs2/security/ASA-2008-032.htm

Third Party Advisory

redhat.com / archives/fedora-package-announce/2007-September/msg00353.html

Third Party Advisory

apache.org / dist/httpd/CHANGES_2.2.6

Broken Link

fujitsu.com / global/support/software/security/products-f/interstage-200807e.html

Third Party Advisory

mandriva.com / security/advisories

Third Party Advisory

novell.com / linux/security/advisories/2007_61_apache2.html

Third Party Advisory

redhat.com / archives/fedora-package-announce/2007-September/msg00320.html

Broken Link

redhat.com / support/errata/RHSA-2007-0911.html

Broken Link

redhat.com / support/errata/RHSA-2008-0004.html

Broken Link

redhat.com / support/errata/RHSA-2008-0005.html

Broken Link

redhat.com / support/errata/RHSA-2008-0006.html

Broken Link

redhat.com / support/errata/RHSA-2008-0008.html

Broken Link

redhat.com / support/errata/RHSA-2008-0261.html

Broken Link

securityfocus.com / archive/1/479237/100/0/threaded

Broken LinkThird Party AdvisoryVDB Entry

securityfocus.com / bid/25653

PatchThird Party AdvisoryVDB Entry

ubuntu.com / usn/usn-575-1

Third Party Advisory

us-cert.gov / cas/techalerts/TA08-150A.html

Third Party AdvisoryUS Government Resource

vupen.com / english/advisories/2008/1697

Permissions RequiredThird Party Advisory