Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP…
Priority MEDIUM 50CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Partial Red Hat: 25 fixed, 1 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.
Summary
Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Why it matters now
EPSS 0.46603 98th percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 25 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 1.3.0 – 1.3.39; 2.0.35 – 2.0.61; 2.2.0 – 2.2.6 | Vulnerable | Apache |
| cpe:2.3:o:fedoraproject:fedora:7:*:*:*:*:*:*:* | 7 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:* | 8 | Vulnerable | Fedoraproject |
| cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* | 6.06 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:* | 6.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:* | 7.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:* | 7.10 | Vulnerable | Canonical |
| cpe:2.3:o:opensuse:opensuse:10.2:*:*:*:*:*:*:* | 10.2 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:* | 10.3 | Vulnerable | openSUSE |
| cpe:2.3:o:suse:linux_enterprise_desktop:9:*:*:*:*:*:*:* | 9 | Vulnerable | SUSE |
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 1.3.0 – 1.3.39; 2.0.35 – 2.0.61; 2.2.0 – 2.2.6 Vulnerable ·Apache
- cpe:2.3:o:fedoraproject:fedora:7:*:*:*:*:*:*:* Versions 7 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:* Versions 8 Vulnerable ·Fedoraproject
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* Versions 6.06 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:* Versions 6.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:* Versions 7.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:* Versions 7.10 Vulnerable ·Canonical
- cpe:2.3:o:opensuse:opensuse:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:* Versions 10.3 Vulnerable ·openSUSE
- cpe:2.3:o:suse:linux_enterprise_desktop:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·SUSE
Remediation
Red Hat 11 advisories
- RHSA-2010:0602 Released 2010-08-04 · Red Hat rating ModerateRed Hat Certificate System 7.3 security update
- Red Hat Certificate System 7.3 for 4AS ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
- Red Hat Certificate System 7.3 for 4ES ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
- RHSA-2008:0524 Released 2008-06-30 · Red Hat rating LowRed Hat Network Satellite Server security update
- Red Hat Satellite v 4.2 (RHEL v.3 AS) jabberd-2.0s10-3.37.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el3.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el3.i386 +8
- Red Hat Satellite v 4.2 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8
- RHSA-2008:0523 Released 2008-06-30 · Red Hat rating LowRed Hat Network Proxy Server security update
- Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS) jabberd-2.0s10-3.37.rhn.i386, rhn-apache-1.3.27-36.rhn.rhel3.i386, rhn-modperl-1.29-16.rhel3.i386
- Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, rhn-apache-1.3.27-36.rhn.rhel4.i386, rhn-modperl-1.29-16.rhel4.i386
Show 8 more Red Hat advisories
- RHSA-2008:0263 Released 2008-05-20 · Red Hat rating LowRed Hat Network Proxy Server security update
- Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, rhn-apache-1.3.27-36.rhn.rhel4.i386, rhn-modperl-1.29-16.rhel4.i386
- RHSA-2008:0261 Released 2008-05-20 · Red Hat rating ModerateRed Hat Network Satellite Server security update
- Red Hat Satellite 5.0 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8
- RHSA-2008:0009 Released 2008-01-21 · Red Hat rating Moderatehttpd security update
- Red Hat Application Stack v2 for Enterprise Linux (v.5) httpd-2.2.4-9.el5s2, httpd-2.2.4-9.el5s2.i386, httpd-devel-2.2.4-9.el5s2 +5
- RHSA-2008:0008 Released 2008-01-15 · Red Hat rating Moderatehttpd security update
- Red Hat Enterprise Linux (v. 5 server) httpd-2.2.3-11.el5_1.3, httpd-2.2.3-11.el5_1.3.i386, httpd-2.2.3-11.el5_1.3.ia64 +13
- Red Hat Enterprise Linux Desktop (v. 5 client) httpd-2.2.3-11.el5_1.3, httpd-2.2.3-11.el5_1.3.i386, mod_ssl-1:2.2.3-11.el5_1.3 +1
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) httpd-2.2.3-11.el5_1.3, httpd-devel-2.2.3-11.el5_1.3, httpd-devel-2.2.3-11.el5_1.3.i386 +2
- RHSA-2008:0007 Released 2008-01-15 · Red Hat rating Moderatehttpd security update
- Red Hat Application Stack v1 for Enterprise Linux AS (v.4) httpd-2.0.59-1.el4s1.10, httpd-2.0.59-1.el4s1.10.i386, httpd-devel-2.0.59-1.el4s1.10 +5
- Red Hat Application Stack v1 for Enterprise Linux ES (v.4) httpd-2.0.59-1.el4s1.10, httpd-2.0.59-1.el4s1.10.i386, httpd-devel-2.0.59-1.el4s1.10 +5
- RHSA-2008:0006 Released 2008-01-15 · Red Hat rating Moderatehttpd security update
- Red Hat Enterprise Linux AS version 4 httpd-2.0.52-38.ent.2, httpd-2.0.52-38.ent.2.i386, httpd-2.0.52-38.ent.2.ia64 +17
- Red Hat Enterprise Linux Desktop version 4 httpd-2.0.52-38.ent.2, httpd-2.0.52-38.ent.2.i386, httpd-devel-2.0.52-38.ent.2 +7
- Red Hat Enterprise Linux ES version 4 httpd-2.0.52-38.ent.2, httpd-2.0.52-38.ent.2.i386, httpd-2.0.52-38.ent.2.ia64 +12
- Red Hat Enterprise Linux WS version 4 httpd-2.0.52-38.ent.2, httpd-2.0.52-38.ent.2.i386, httpd-2.0.52-38.ent.2.ia64 +12
- RHSA-2008:0005 Released 2008-01-15 · Red Hat rating Moderatehttpd security update
- Red Hat Desktop version 3 httpd-2.0.46-70.ent, httpd-2.0.46-70.ent.i386, httpd-devel-2.0.46-70.ent +3
- Red Hat Enterprise Linux AS version 3 httpd-2.0.46-70.ent, httpd-2.0.46-70.ent.i386, httpd-2.0.46-70.ent.ia64 +9
- Red Hat Enterprise Linux ES version 3 httpd-2.0.46-70.ent, httpd-2.0.46-70.ent.i386, httpd-2.0.46-70.ent.ia64 +6
- Red Hat Enterprise Linux WS version 3 httpd-2.0.46-70.ent, httpd-2.0.46-70.ent.i386, httpd-2.0.46-70.ent.ia64 +6
- RHSA-2008:0004 Released 2008-01-15 · Red Hat rating Moderateapache security update
- Red Hat Enterprise Linux AS (Advanced Server) version 2.1 apache-1.3.27-14.ent, apache-1.3.27-14.ent.i386, apache-1.3.27-14.ent.ia64 +4
- Red Hat Enterprise Linux ES version 2.1 apache-1.3.27-14.ent, apache-1.3.27-14.ent.i386, apache-devel-1.3.27-14.ent.i386 +1
- Red Hat Enterprise Linux WS version 2.1 apache-1.3.27-14.ent, apache-1.3.27-14.ent.i386, apache-devel-1.3.27-14.ent.i386 +1
- Red Hat Linux Advanced Workstation 2.1 apache-1.3.27-14.ent, apache-1.3.27-14.ent.ia64, apache-devel-1.3.27-14.ent.ia64 +1
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Directory Server 8 | Affected | No fix planned: Will not fix |
| Red Hat Application Stack v1 for Enterprise Linux AS (v.4) | Fixed | RHSA-2008:0007 |
| Red Hat Application Stack v1 for Enterprise Linux ES (v.4) | Fixed | RHSA-2008:0007 |
| Red Hat Certificate System 7.3 for 4AS | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 for 4ES | Fixed | RHSA-2010:0602 |
| Red Hat Desktop version 3 | Fixed | RHSA-2008:0005 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2008:0008 |
| Red Hat Enterprise Linux AS (Advanced Server) version 2.1 | Fixed | RHSA-2008:0004 |
| Red Hat Enterprise Linux AS version 3 | Fixed | RHSA-2008:0005 |
| Red Hat Enterprise Linux AS version 4 | Fixed | RHSA-2008:0006 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2008:0008 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2008:0008 |
| Red Hat Enterprise Linux Desktop version 4 | Fixed | RHSA-2008:0006 |
| Red Hat Enterprise Linux ES version 2.1 | Fixed | RHSA-2008:0004 |
| Red Hat Enterprise Linux ES version 3 | Fixed | RHSA-2008:0005 |
| Red Hat Enterprise Linux ES version 4 | Fixed | RHSA-2008:0006 |
| Red Hat Enterprise Linux WS version 2.1 | Fixed | RHSA-2008:0004 |
| Red Hat Enterprise Linux WS version 3 | Fixed | RHSA-2008:0005 |
| Red Hat Enterprise Linux WS version 4 | Fixed | RHSA-2008:0006 |
| Red Hat Linux Advanced Workstation 2.1 | Fixed | RHSA-2008:0004 |
| Red Hat Satellite 5.0 (RHEL v.4 AS) | Fixed | RHSA-2008:0261 |
| Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS) | Fixed | RHSA-2008:0523 |
| Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS) | Fixed | RHSA-2008:0523 |
| Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS) | Fixed | RHSA-2008:0263 |
| Red Hat Satellite v 4.2 (RHEL v.3 AS) | Fixed | RHSA-2008:0524 |
| Red Hat Satellite v 4.2 (RHEL v.4 AS) | Fixed | RHSA-2008:0524 |
Timeline
- 2026-10-02 Threatist record created from CVE-2007-5000
- 2026-10-03 Alias added: GHSA-wxg8-rr3m-222p
References
Advisory 33
- RHSA-2008:0005
- SSA:2008-045-02
- SSRT090208
- FEDORA-2008-1695
- PK58024
- http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
- RHSA-2008:0006
- 233623
- RHSA-2008:0007
- http://httpd.apache.org/security/vulnerabilities_20.html
- TA08-150A
- RHSA-2008:0008
- FEDORA-2008-1711
- RHSA-2008:0009
- MDVSA-2008:014
- http://httpd.apache.org/security/vulnerabilities_22.html
- APPLE-SA-2008-03-18
- oval:org.mitre.oval:def:9539
- APPLE-SA-2008-05-28
- http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm
- PK65782
- RHSA-2008:0004
- [security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server
- SUSE-SA:2008:021
- http://httpd.apache.org/security/vulnerabilities_13.html
- PK63273
- MDVSA-2008:015
- SSRT080010
- RHSA-2008:0261
- USN-575-1
- PK58074
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-200801e.html
- MDVSA-2008:016
Other 33
- ADV-2008-0178
- 39134
- ADV-2008-1623
- ADV-2008-0924
- ADV-2008-0084
- ADV-2007-4301
- ADV-2008-0398
- ADV-2008-0809
- http://docs.info.apple.com/article.html?artnum=307562
- ADV-2007-4202
- ADV-2008-1697
- ADV-2007-4201
- ADV-2008-1875
- ADV-2008-1224
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1888194 [5/13] - /httpd/site/trunk/content/security/json/
- [httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073139 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/
- [httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
Sources
- CVE-2007-5000 · CVE Program
- CVE-2007-5000 · NVD
- FIRST EPSS
- GHSA-wxg8-rr3m-222p · GitHub Advisory Database · CC BY 4.0
- CVE-2007-5000 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences