Description

mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.

Remediation

References

CVE-2008-0005

Related Vulnerabilities

Internet Information Services Configuration Vulnerability (CVE-1999-0725)

XWiki URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2023-29204)

Envoy Proxy Out-of-bounds Write Vulnerability (CVE-2024-34364)

DWR Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-5325)

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-42111)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2008-0005