CVE Feed

Dashboard / CVE / CVE-2007-6388

CVE-2007-6388

Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Published:Dec 29, 2007

Last Modified:Apr 23, 2026

EPS:Jan 8, 2008

EPSS Score:0.85047

CVSS Score:4.3

Affected Products

Vendor

Product

Action

Vendor

Apache

Product

Http Server

Apache

Http Server

Vendor

Redhat

Product

Certificate System

Redhat

Certificate System

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Vendor

Redhat

Product

Network Proxy

Redhat

Network Proxy

Vendor

Redhat

Product

Network Satellite

Redhat

Network Satellite

Vendor

Redhat

Product

Rhel Application Stack

Redhat

Rhel Application Stack

Exploits

No exploit reference

Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-209 XSS Using MIME Type Mismatch

CAPEC-588 DOM-Based XSS

CAPEC-591 Reflected XSS

CAPEC-592 Stored XSS

CAPEC-63 Cross-Site Scripting (XSS)

CAPEC-85 AJAX Footprinting

Related CVEs

CVE-2026-48913 (CVSS 7.3) — Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. …

CVE-2026-42536 (CVSS 7.5) — Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted…

CVE-2026-44185 (CVSS 7.3) — Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP…

CVE-2026-34355 (CVSS 7.5) — A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted …

CVE-2026-44631 (CVSS 9.8) — Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. Th…

CVE-2026-44119 (CVSS 5.5) — Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess au…

CVE-2026-43951 (CVSS 6.5) — Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response lan…

CVE-2026-42535 (CVSS 9.1) — A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly ma…

CVE-2026-34356 (CVSS 7.5) — Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassRev…

CVE-2026-44186 (CVSS 7.3) — Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTT…

References

http://docs.info.apple.com/article.html?artnum=307562

http://httpd.apache.org/security/vulnerabilities_13.html

http://httpd.apache.org/security/vulnerabilities_20.html

http://httpd.apache.org/security/vulnerabilities_22.html

http://lists.apple.com/archives/security-announce/2008//May/msg00001.html

http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html

http://lists.vmware.com/pipermail/security-announce/2009/000062.html

http://marc.info/?l=bugtraq&m=130497311408250&w=2

http://secunia.com/advisories/28467

http://secunia.com/advisories/28471

http://secunia.com/advisories/28526

http://secunia.com/advisories/28607

http://secunia.com/advisories/28749

http://secunia.com/advisories/28922

http://secunia.com/advisories/28965

http://secunia.com/advisories/28977

http://secunia.com/advisories/29420

http://secunia.com/advisories/29504

http://secunia.com/advisories/29640

http://secunia.com/advisories/29806

http://secunia.com/advisories/29988

http://secunia.com/advisories/30356

http://secunia.com/advisories/30430

http://secunia.com/advisories/30732

http://secunia.com/advisories/31142

http://secunia.com/advisories/32800

http://secunia.com/advisories/33200

http://securityreason.com/securityalert/3541

http://securitytracker.com/id?1019154

http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748

http://sunsolve.sun.com/search/document.do?assetkey=1-26-233623-1

http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm

http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=689039

http://www-1.ibm.com/support/docview.wss?uid=swg1PK62966

http://www-1.ibm.com/support/docview.wss?uid=swg1PK63273

http://www-1.ibm.com/support/docview.wss?uid=swg24019245

http://www-1.ibm.com/support/search.wss?rs=0&q=PK59667&apar=only

http://www.fujitsu.com/global/support/software/security/products-f/interstage-200808e.html

http://www.mandriva.com/security/advisories?name=MDVSA-2008:014

http://www.mandriva.com/security/advisories?name=MDVSA-2008:015

http://www.mandriva.com/security/advisories?name=MDVSA-2008:016

http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html

http://www.redhat.com/support/errata/RHSA-2008-0004.html

http://www.redhat.com/support/errata/RHSA-2008-0005.html

http://www.redhat.com/support/errata/RHSA-2008-0006.html

http://www.redhat.com/support/errata/RHSA-2008-0007.html

http://www.redhat.com/support/errata/RHSA-2008-0008.html

http://www.redhat.com/support/errata/RHSA-2008-0009.html

http://www.redhat.com/support/errata/RHSA-2008-0261.html

http://www.securityfocus.com/archive/1/488082/100/0/threaded

http://www.securityfocus.com/archive/1/494428/100/0/threaded

http://www.securityfocus.com/archive/1/498523/100/0/threaded

http://www.securityfocus.com/archive/1/505990/100/0/threaded

http://www.securityfocus.com/bid/27237

http://www.ubuntu.com/usn/usn-575-1

http://www.us-cert.gov/cas/techalerts/TA08-150A.html

http://www.vupen.com/english/advisories/2008/0047

http://www.vupen.com/english/advisories/2008/0447/references

http://www.vupen.com/english/advisories/2008/0554

http://www.vupen.com/english/advisories/2008/0809/references

http://www.vupen.com/english/advisories/2008/0924/references

http://www.vupen.com/english/advisories/2008/0986/references

http://www.vupen.com/english/advisories/2008/1224/references

http://www.vupen.com/english/advisories/2008/1623/references

http://www.vupen.com/english/advisories/2008/1697

http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2008/05/023342-01.pdf

https://exchange.xforce.ibmcloud.com/vulnerabilities/39472

https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10272

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html

http://docs.info.apple.com/article.html?artnum=307562

http://httpd.apache.org/security/vulnerabilities_13.html

http://httpd.apache.org/security/vulnerabilities_20.html

http://httpd.apache.org/security/vulnerabilities_22.html

http://lists.apple.com/archives/security-announce/2008//May/msg00001.html

http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html

http://lists.vmware.com/pipermail/security-announce/2009/000062.html

http://marc.info/?l=bugtraq&m=130497311408250&w=2

http://secunia.com/advisories/28467

http://secunia.com/advisories/28471

http://secunia.com/advisories/28526

http://secunia.com/advisories/28607

http://secunia.com/advisories/28749

http://secunia.com/advisories/28922

http://secunia.com/advisories/28965

http://secunia.com/advisories/28977

http://secunia.com/advisories/29420

http://secunia.com/advisories/29504

http://secunia.com/advisories/29640

http://secunia.com/advisories/29806

http://secunia.com/advisories/29988

http://secunia.com/advisories/30356

http://secunia.com/advisories/30430

http://secunia.com/advisories/30732

http://secunia.com/advisories/31142

http://secunia.com/advisories/32800

http://secunia.com/advisories/33200

http://securityreason.com/securityalert/3541

http://securitytracker.com/id?1019154

http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748

http://sunsolve.sun.com/search/document.do?assetkey=1-26-233623-1

http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm

http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=689039

http://www-1.ibm.com/support/docview.wss?uid=swg1PK62966

http://www-1.ibm.com/support/docview.wss?uid=swg1PK63273

http://www-1.ibm.com/support/docview.wss?uid=swg24019245

http://www-1.ibm.com/support/search.wss?rs=0&q=PK59667&apar=only

http://www.fujitsu.com/global/support/software/security/products-f/interstage-200808e.html

http://www.mandriva.com/security/advisories?name=MDVSA-2008:014

http://www.mandriva.com/security/advisories?name=MDVSA-2008:015

http://www.mandriva.com/security/advisories?name=MDVSA-2008:016

http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html

http://www.redhat.com/support/errata/RHSA-2008-0004.html

http://www.redhat.com/support/errata/RHSA-2008-0005.html

http://www.redhat.com/support/errata/RHSA-2008-0006.html

http://www.redhat.com/support/errata/RHSA-2008-0007.html

http://www.redhat.com/support/errata/RHSA-2008-0008.html

http://www.redhat.com/support/errata/RHSA-2008-0009.html

http://www.redhat.com/support/errata/RHSA-2008-0261.html

http://www.securityfocus.com/archive/1/488082/100/0/threaded

http://www.securityfocus.com/archive/1/494428/100/0/threaded

http://www.securityfocus.com/archive/1/498523/100/0/threaded

http://www.securityfocus.com/archive/1/505990/100/0/threaded

http://www.securityfocus.com/bid/27237

http://www.ubuntu.com/usn/usn-575-1

http://www.us-cert.gov/cas/techalerts/TA08-150A.html

http://www.vupen.com/english/advisories/2008/0047

http://www.vupen.com/english/advisories/2008/0447/references

http://www.vupen.com/english/advisories/2008/0554

http://www.vupen.com/english/advisories/2008/0809/references

http://www.vupen.com/english/advisories/2008/0924/references

http://www.vupen.com/english/advisories/2008/0986/references

http://www.vupen.com/english/advisories/2008/1224/references

http://www.vupen.com/english/advisories/2008/1623/references

http://www.vupen.com/english/advisories/2008/1697

http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2008/05/023342-01.pdf

https://exchange.xforce.ibmcloud.com/vulnerabilities/39472

https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10272

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High