CVE-2008-0005

23

FAUCET Score

CVE-2008-0005 describes a cross-site scripting (XSS) vulnerability in the mod_proxy_ftp module of Apache HTTP Server versions 2.2.x, 2.0.x, and 1.3.x. The absence of a defined charset allows remote attackers to inject malicious scripts via UTF-7 encoding. This vulnerability has a CVSS score of 4.3, indicating a medium attack complexity and partial integrity impact, but no confidentiality or availability impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.0.35, < 2.0.63CPE matchmatch criteria	cpe:2.3:a:apache:http_server::::::::
		>= 2.2.0, < 2.2.8CPE matchmatch criteria	cpe:2.3:a:apache:http_server::::::::
		7CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:7:::::::*
		8CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:8:::::::*
		6.06CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*

CVSS Data

CVSS version used by this source: 2.0

4.3MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Exploitability Score

8.6

Impact Score

2.9

CvssVersion

2.0

Exploit Intelligence

EPSS Score

14.61%

Probability of exploitation in next 30 days

EPSS Percentile

96.3%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.1461 is in the 96th percentile among its peer group of 19,958 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (25)

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: ant-0:1.6.5-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: avalon-logkit-0:1.2-2jpp_4rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: axis-0:1.2.1-1jpp_3rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: classpathx-jaf-0:1.0-2jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: classpathx-mail-0:1.1.1-2jpp_8rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: geronimo-specs-0:1.0-0.M4.1jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: jakarta-commons-modeler-0:2.0-3jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: log4j-0:1.2.12-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: mx4j-1:3.0.1-1jpp_4rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: pcsc-lite-0:1.3.3-3.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-ca-0:7.3.0-20.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-java-tools-0:7.3.0-10.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-kra-0:7.3.0-14.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-manage-0:7.3.0-19.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-native-tools-0:7.3.0-6.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-ocsp-0:7.3.0-13.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-tks-0:7.3.0-13.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: tomcat5-0:5.5.23-0jpp_4rh.16

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: xerces-j2-0:2.7.1-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: xml-commons-0:1.3.02-2jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 2.1Fixed in: apache-0:1.3.27-14.ent

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 3Fixed in: httpd-0:2.0.46-70.ent

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 4Fixed in: httpd-0:2.0.52-38.ent.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: httpd-0:2.2.3-11.el5_1.3

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: httpd-0:2.0.59-1.el4s1.10

Vendor Advisories (1)

redhatCVE-2008-0005Low

mod_proxy_ftp XSS

References

docs.info.apple.com / article.html

Broken Link

lists.apple.com / archives/security-announce/2008/Mar/msg00001.html

Broken LinkMailing List

lists.opensuse.org / opensuse-security-announce/2008-04/msg00004.html

Mailing ListThird Party Advisory

lists.vmware.com / pipermail/security-announce/2009/000062.html

Mailing ListThird Party Advisory

Issue TrackingMailing ListThird Party Advisory

Issue TrackingMailing ListThird Party Advisory

Issue TrackingMailing ListThird Party Advisory

secunia.com / advisories/28467

Not Applicable

secunia.com / advisories/28471

Not Applicable

secunia.com / advisories/28526

Not Applicable

secunia.com / advisories/28607

Not Applicable

secunia.com / advisories/28749

Not Applicable

secunia.com / advisories/28977

Not Applicable

secunia.com / advisories/29348

Not Applicable

secunia.com / advisories/29420

Not Applicable

secunia.com / advisories/29640

Not Applicable

secunia.com / advisories/30732

Not Applicable

secunia.com / advisories/35650

Not Applicable

security.gentoo.org / glsa/glsa-200803-19.xml

Third Party Advisory

securityreason.com / achievement_securityalert/49

ExploitThird Party Advisory

securityreason.com / securityalert/3526

ExploitThird Party Advisory

exchange.xforce.ibmcloud.com / vulnerabilities/39615

Third Party AdvisoryVDB Entry

lists.apache.org / thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10812

Third Party Advisory

support.avaya.com / elmodocs2/security/ASA-2008-032.htm

Third Party Advisory

redhat.com / archives/fedora-package-announce/2008-February/msg00541.html

Mailing ListThird Party Advisory

redhat.com / archives/fedora-package-announce/2008-February/msg00562.html

Mailing ListThird Party Advisory

mandriva.com / security/advisories

Broken Link

mandriva.com / security/advisories

Broken Link

mandriva.com / security/advisories

Broken Link

redhat.com / support/errata/RHSA-2008-0004.html

Third Party Advisory

redhat.com / support/errata/RHSA-2008-0005.html

Third Party Advisory

redhat.com / support/errata/RHSA-2008-0006.html

Third Party Advisory

redhat.com / support/errata/RHSA-2008-0007.html

Third Party Advisory

redhat.com / support/errata/RHSA-2008-0008.html

Third Party Advisory

redhat.com / support/errata/RHSA-2008-0009.html

Third Party Advisory

securityfocus.com / archive/1/486167/100/0/threaded

Third Party AdvisoryVDB Entry

securityfocus.com / archive/1/505990/100/0/threaded

Third Party AdvisoryVDB Entry

securityfocus.com / bid/27234

Third Party AdvisoryVDB Entry

securitytracker.com / id

Broken LinkThird Party AdvisoryVDB Entry

ubuntu.com / usn/usn-575-1

Third Party Advisory

vupen.com / english/advisories/2008/0924/references

Permissions Required

vupen.com / english/advisories/2008/1875/references

Permissions Required