CVE-2008-2939

Description

Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.

Category

4.3
CVSS
Severity: Medium
CVSS 2.0 •
EPSS 64.83% Top 5%
Vendor Advisory marc.info Vendor Advisory opensuse.org Vendor Advisory sun.com Vendor Advisory redhat.com Vendor Advisory apple.com Vendor Advisory ubuntu.com Vendor Advisory ibm.com Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory ibm.com Vendor Advisory mandriva.com Vendor Advisory marc.info Vendor Advisory mandriva.com
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://svn.apache.org/viewvc?view=rev&revision=682868 third party advisory
http://secunia.com/advisories/34219 third party advisory broken link
http://marc.info/?l=bugtraq&m=125631037611762&w=2 third party advisory vendor advisory
http://support.apple.com/kb/HT3549 third party advisory
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html third party advisory vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-247666-1 vendor advisory broken link
http://secunia.com/advisories/32838 third party advisory broken link
http://www.securityfocus.com/archive/1/498567/100/0/threaded mailing list third party advisory vdb entry
http://www.rapid7.com/advisories/R7-0033 broken link
http://secunia.com/advisories/35074 third party advisory broken link
http://rhn.redhat.com/errata/RHSA-2008-0967.html third party advisory vendor advisory
http://www.securityfocus.com/bid/30560 third party advisory vdb entry
http://secunia.com/advisories/32685 third party advisory broken link
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html vendor advisory mailing list
http://www.ubuntu.com/usn/USN-731-1 vendor advisory third party advisory vdb entry
http://secunia.com/advisories/31673 third party advisory broken link
http://www.vupen.com/english/advisories/2009/0320 vdb entry permissions required
http://www.securityfocus.com/archive/1/495180/100/0/threaded mailing list third party advisory vdb entry
http://www-1.ibm.com/support/docview.wss?uid=swg1PK70197 third party advisory vendor advisory
http://www.redhat.com/support/errata/RHSA-2008-0966.html third party advisory vendor advisory
http://secunia.com/advisories/33156 third party advisory broken link
http://secunia.com/advisories/33797 third party advisory broken link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11316 signature vdb entry broken link
http://www.vupen.com/english/advisories/2008/2461 vdb entry permissions required
http://www.mandriva.com/security/advisories?name=MDVSA-2008:194 vendor advisory broken link
http://www-1.ibm.com/support/docview.wss?uid=swg1PK70937 third party advisory vendor advisory
http://secunia.com/advisories/31384 third party advisory broken link
http://www.us-cert.gov/cas/techalerts/TA09-133A.html third party advisory us government resource
http://www.securitytracker.com/id?1020635 third party advisory vdb entry
http://www.vupen.com/english/advisories/2009/1297 vdb entry permissions required
http://svn.apache.org/viewvc?view=rev&revision=682871 third party advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:124 vendor advisory broken link
http://marc.info/?l=bugtraq&m=123376588623823&w=2 third party advisory vendor advisory
http://wiki.rpath.com/Advisories:rPSA-2008-0327 broken link
http://www.kb.cert.org/vuls/id/663763 third party advisory us government resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/44223 vdb entry
http://www.mandriva.com/security/advisories?name=MDVSA-2008:195 vendor advisory broken link
http://www.securityfocus.com/archive/1/498566/100/0/threaded mailing list third party advisory vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7716 signature vdb entry broken link
http://www.vupen.com/english/advisories/2008/2315 vdb entry permissions required
http://svn.apache.org/viewvc?view=rev&revision=682870 third party advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0328 broken link
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E third party advisory mailing list

Frequently Asked Questions

What is the severity of CVE-2008-2939?
CVE-2008-2939 has been scored as a medium severity vulnerability.
How to fix CVE-2008-2939?
To fix CVE-2008-2939, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2008-2939 being actively exploited in the wild?
It is possible that CVE-2008-2939 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~65% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.