CVE-2008-2168
Estado: ModificadaMedia (4.3)—💥 Exploit
Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
- Puntuación base: 4.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 55%
- Percentil entre todas las CVEs puntuadas: 99
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
💥 Exploits públicos
Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.
- Publicado en Exploit-DB · Microsoft Internet Explorer 2 - UTF-7 HTTP Response Handling (8/5/2008)
Tecnologías afectadas (1)
CWE
- CWE-79
Referencias
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432
- http://marc.info/?l=bugtraq&m=124654546101607&w=2
- http://marc.info/?l=bugtraq&m=125631037611762&w=2
- http://secunia.com/advisories/31651
- http://secunia.com/advisories/34219
- http://secunia.com/advisories/35650
- http://securityreason.com/securityalert/3889
- http://www.securityfocus.com/archive/1/491862/100/0/threaded
- http://www.securityfocus.com/archive/1/491901/100/0/threaded
- http://www.securityfocus.com/archive/1/491930/100/0/threaded
- http://www.securityfocus.com/archive/1/491967/100/0/threaded
- http://www.securityfocus.com/bid/29112
- http://www.ubuntu.com/usn/USN-731-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42303
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5143
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432
- http://marc.info/?l=bugtraq&m=124654546101607&w=2
- http://marc.info/?l=bugtraq&m=125631037611762&w=2
- http://secunia.com/advisories/31651
- http://secunia.com/advisories/34219
- http://secunia.com/advisories/35650
- http://securityreason.com/securityalert/3889
- http://www.securityfocus.com/archive/1/491862/100/0/threaded
- http://www.securityfocus.com/archive/1/491901/100/0/threaded
- http://www.securityfocus.com/archive/1/491930/100/0/threaded
- http://www.securityfocus.com/archive/1/491967/100/0/threaded
- http://www.securityfocus.com/bid/29112
- http://www.ubuntu.com/usn/USN-731-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42303
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5143
JSON original (NVD)
Mostrar
{
"id": "CVE-2008-2168",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2008-05-13T21:20:00.000",
"references": [
{
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"source": "cve@mitre.org"
},
{
"url": "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"source": "cve@mitre.org"
},
{
"url": "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/31651",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/34219",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/35650",
"source": "cve@mitre.org"
},
{
"url": "http://securityreason.com/securityalert/3889",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/491862/100/0/threaded",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/491901/100/0/threaded",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/491930/100/0/threaded",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/491967/100/0/threaded",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/29112",
"tags": [
"Exploit"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.ubuntu.com/usn/USN-731-1",
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42303",
"source": "cve@mitre.org"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5143",
"source": "cve@mitre.org"
},
{
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/31651",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/34219",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/35650",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://securityreason.com/securityalert/3889",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/491862/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/491901/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/491930/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/491967/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/29112",
"tags": [
"Exploit"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.ubuntu.com/usn/USN-731-1",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42303",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5143",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page."
},
{
"lang": "es",
"value": "La vulnerabilidad de tipo cross-site-scripting (XSS) en Apache versión 2.2.6 y anteriores, permite a los atacantes remotos inyectar scripts web o HTML arbitrarios por medio de direcciones URL codificadas UTF-7 que no se manejan apropiadamente cuando se muestra la página de error 403 Forbidden ."
}
],
"lastModified": "2026-06-16T22:53:13.483",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:http_server:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D623D8C0-65D2-4269-A1D4-5CB3899F44C8"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "163A6EF6-7D3F-4B1F-9E03-A8C86562CC3D"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "154566FB-0D1A-4DC2-AFE6-49DE93850951"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB477AFB-EA39-4892-B772-586CF6D2D235"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5C4962BB-0E61-4788-B582-21F05CD33AD3"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B35906CD-038E-4243-8A95-F0A3A43F06F7"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.32:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C3E2656-8071-40DA-9480-AC13010A9D09"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.34:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7C649D2F-A633-456E-899C-6253FDE9A626"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B940BB85-03F5-46D7-8DC9-2E1E228D3D98"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "82139FFA-2779-4732-AFA5-4E6E19775899"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B7F717E6-BACD-4C8A-A9C5-516ADA6FEE6C"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08AB120B-2FEC-4EB3-9777-135D81E809AA"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C7FF669-12E0-4A73-BBA7-250D109148C5"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5AB7B1F1-7202-445D-9F96-135DC0AFB1E9"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BCB7EE53-187E-40A9-9865-0F3EDA2B5A4C"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9D06AE8A-9BA8-4AA8-ACEA-326CD001E879"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2FC1A04B-0466-48AD-89F3-1F2EF1DEBE6A"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "19F34D08-430E-4331-A27D-667149425176"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "248BDF2C-3E78-49D1-BD9C-60C09A441724"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB0FDE3D-1509-4375-8703-0D174D70B22E"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AFE732B5-00C9-4443-97E0-1DF21475C26B"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C79C41D3-6894-4F2D-B8F8-82AB4780A824"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "449A5647-CEA6-4314-9DB8-D086F388E1C7"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5A407B7-F432-48F0-916A-A49952F85CA6"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B5AC769-D07D-43C7-B252-A5A812E7D58C"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ADF4DBF6-DAF0-47E7-863B-C48DB7149A78"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F2F19D71-0A58-4B03-B351-596EB67ECF80"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5EBB3FF9-CF5A-4E7B-ACE3-A198343AD485"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D721FFB5-D6D3-4F60-8B09-B3AD07EE6D4D"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.56:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97E8F32E-C2E5-44E3-A920-F09AF919D372"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.57:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0CF37A82-49B6-45D4-B91D-FDA2D4463A0C"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.58:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "030D1767-2DF7-48E3-B462-4B49CA751B35"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.59:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5236DC61-5557-4C24-8F5B-F48548448588"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.60:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8CB9F19A-5DC0-4C44-8BAF-B8FD047DAB56"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.0.61:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B468F9B-2514-425C-9279-0FCAF73BBD18"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "00BC31A3-B9AC-4776-83C1-668636B74104"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D72E88F0-AB0F-4B6F-AE86-71B0DE84BD75"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "840FF871-79EC-472C-91BD-9E9AFC36B408"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "191E8654-5338-4051-A1D5-EE491D594F13"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B26CC819-7315-456F-9F95-2A64FCE6AC26"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3774827-AB0B-4A95-844B-9BC904A9FE98"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.1.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "18D07925-542B-4369-AA21-5587703E12E0"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.1.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACC83EB5-4E9A-4EA9-8D9F-BDBF5F60C54A"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.1.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80632488-5C7E-4C70-BB60-BC4756187670"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACBC75F8-C1AF-45AE-91BA-5670EF2D0DCD"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "733D62FE-180A-4AE8-9DBF-DA1DC18C1932"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CCBBB7FE-35FC-4515-8393-5145339FCE4D"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F519633F-AB68-495A-B85E-FD41F9F752CA"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A894BED6-C97D-4DA4-A13D-9CB2B3306BC5"
}
],
"operator": "OR"
}
]
}
],
"vendorComments": [
{
"comment": "The Apache security team state that this issue is due to web browsers that are violating RFC2616 and is not a flaw in the Apache HTTPD Server.",
"lastModified": "2008-05-14T00:00:00",
"organization": "Apache"
},
{
"comment": "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the "AddDefaultCharset" directive. \nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-2168",
"lastModified": "2008-05-14T00:00:00",
"organization": "Red Hat"
}
],
"sourceIdentifier": "cve@mitre.org"
}