Description
Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.2.8-1 | — |
| Debian 13 | apache2 | 2.2.8-1 | — |
| Debian 12 | apache2 | 2.2.8-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | httpd +2 | 2.2.3-11.el5_1.3 | RHSA-2008:0008 |
| RHEL 5 | mod_ssl | 1:2.2.3-11.el5_1.3 | RHSA-2008:0008 |
| RHEL 4 | httpd +3 | 2.0.52-38.ent.2 | RHSA-2008:0006 |
| RHEL 4 | mod_ssl | 1:2.0.52-38.ent.2 | RHSA-2008:0006 |
| RHEL 3 | httpd +1 | 2.0.46-70.ent | RHSA-2008:0005 |
| RHEL 3 | mod_ssl | 1:2.0.46-70.ent | RHSA-2008:0005 |
| RHEL 2 | apache +2 | 1.3.27-14.ent | RHSA-2008:0004 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 2 | httpd +2 | 2.2.4-9.el5s2 | RHSA-2008:0009 |
| Red Hat Rhel Application Stack 2 | mod_ssl | 1:2.2.4-9.el5s2 | RHSA-2008:0009 |
| Red Hat Rhel Application Stack 1 | httpd +2 | 2.0.59-1.el4s1.10 | RHSA-2008:0007 |
| Red Hat Rhel Application Stack 1 | mod_ssl | 1:2.0.59-1.el4s1.10 | RHSA-2008:0007 |
| Red Hat Network Satellite 5 | jabberd | 2.0s10-3.38.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | openmotif21 | 2.1.30-11.RHEL4.6 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | perl-Crypt-CBC | 2.24-1.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-apache | 1.3.27-36.rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modperl | 1.29-16.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modssl | 2.8.12-8.rhn.10.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0261 |
| Red Hat Network Satellite 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | openmotif21 | 2.1.30-9.RHEL3.8 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | perl-Crypt-CBC | 2.24-1.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modssl | 2.8.12-8.rhn.10.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0524 |
| Red Hat Network Proxy 5 | jabberd | 2.0s10-3.38.rhn | RHSA-2008:0263 |
| Red Hat Network Proxy 5 | rhn-apache | 1.3.27-36.rhn.rhel4 | RHSA-2008:0263 |
| Red Hat Network Proxy 5 | rhn-modperl | 1.29-16.rhel4 | RHSA-2008:0263 |
| Red Hat Network Proxy 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0523 |
| Red Hat Network Proxy 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0523 |
| Red Hat Network Proxy 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0523 |
| Red Hat Certificate System 7 | ant | 1.6.5-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | avalon-logkit | 1.2-2jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | axis | 1.2.1-1jpp_3rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-jaf | 1.0-2jpp_6rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-mail | 1.1.1-2jpp_8rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | geronimo-specs +10 | 1.0-0.M4.1jpp_10rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | jakarta-commons-modeler | 2.0-3jpp_2rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | log4j | 1.2.12-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | mx4j | 1:3.0.1-1jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | pcsc-lite +2 | 1.3.3-3.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-ca | 7.3.0-20.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-java-tools | 7.3.0-10.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-kra | 7.3.0-14.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-manage | 7.3.0-19.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-native-tools | 7.3.0-6.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-tks +1 | 7.3.0-13.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.16 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xerces-j2 | 2.7.1-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xml-commons +1 | 1.3.02-2jpp_1rh | RHSA-2010:0602 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.49-1.1 | openSUSE-SU-2024:10623-1 |
Advisories 12
- RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0523 Red Hat Security Advisory: Red Hat Network Proxy Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0261 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0008 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0006 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0004 Red Hat Security Advisory: apache security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0005 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10623-1 apache2-2.4.49-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2008:0263 Red Hat Security Advisory: Red Hat Network Proxy Server security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0009 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0007 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2008:0005 vendor-advisory
- ADV-2008-0554 vdb-entry
- ADV-2008-0447 vdb-entry
- 28922 third-party-advisory
- ADV-2008-0986 vdb-entry
- 3541 third-party-advisory
- 28749 third-party-advisory
- SSA:2008-045-02 vendor-advisory
- 29988 third-party-advisory
- SSRT090208 vendor-advisory
- ADV-2008-1623 vdb-entry
- 29806 third-party-advisory
- 20080716 rPSA-2008-0035-1 httpd mod_ssl mailing-list
- FEDORA-2008-1695 vendor-advisory
- 1019154 vdb-entry
- 28526 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
- RHSA-2008:0006 vendor-advisory
- oval:org.mitre.oval:def:10272 vdb-entry signature
- 31142 third-party-advisory
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-200808e.html
- ADV-2008-0924 vdb-entry
- 233623 vendor-advisory
- RHSA-2008:0007 vendor-advisory
- http://httpd.apache.org/security/vulnerabilities_20.html
- ADV-2008-0047 vdb-entry
- TA08-150A third-party-advisory
- RHSA-2008:0008 vendor-advisory
- FEDORA-2008-1711 vendor-advisory
- RHSA-2008:0009 vendor-advisory
- MDVSA-2008:014 vendor-advisory
- 29420 third-party-advisory
- 29504 third-party-advisory
- http://httpd.apache.org/security/vulnerabilities_22.html
- SSRT080015 vendor-advisory
- APPLE-SA-2008-03-18 vendor-advisory
- 30430 third-party-advisory
- APPLE-SA-2008-05-28 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm
- apache-status-page-xss(39472) vdb-entry
- ADV-2008-0809 vdb-entry
- 20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server mailing-list
- 28467 third-party-advisory
- SSRT080059 vendor-advisory
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=689039
- PK65782 vendor-advisory
- RHSA-2008:0004 vendor-advisory
- [security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server mailing-list
- 28607 third-party-advisory
- PK62966 vendor-advisory
- SUSE-SA:2008:021 vendor-advisory
- 30356 third-party-advisory
- http://httpd.apache.org/security/vulnerabilities_13.html
- PK63273 vendor-advisory
- MDVSA-2008:015 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=307562
- 33200 third-party-advisory
- 28965 third-party-advisory
- http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2008/05/023342-01.pdf
- 28471 third-party-advisory