CVE-2008-2939

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 39.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-08-06 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.

Affected products

Apache HTTP Server: through 2.0.63; from 2.2.0 through 2.2.9
macOS: through 10.5.6
Canonical Ubuntu Linux: 6.06, 7.10, 8.04
Opensuse: 10.2, 10.3, 11.0

References

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html
http://marc.info/?l=bugtraq&m=123376588623823&w=2
http://marc.info/?l=bugtraq&m=125631037611762&w=2
http://rhn.redhat.com/errata/RHSA-2008-0967.html
http://secunia.com/advisories/31384
http://secunia.com/advisories/31673
http://secunia.com/advisories/32685
http://secunia.com/advisories/32838
http://secunia.com/advisories/33156
http://secunia.com/advisories/33797
http://secunia.com/advisories/34219

Get alerted when CVE-2008-2939 or the next vulnerability affects your stack