Vulnerability record · CVE-2007-5000 · published 13 December 2007
CVE-2007-5000: Apache HTTP Server mod_imap/mod_imagemap XSS
Apache · Http Server
The mod_imap module in Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61, and the mod_imagemap module in 2.2.0 through 2.2.6, are vulnerable to cross-site scripting via unspecified vectors. An attacker can inject arbitrary web script or HTML into a response, which matters because it can be used to hijack sessions or deface pages served by the affected server.
Description
Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
AV:N/AC:M/Au:N/C:N/I:P/A:N
Automated analysis
medium priorityCVSS 2.0 rates it medium (4.3) with partial integrity impact only, but the high EPSS percentile and broad Apache deployment warrant timely patching.
What it is
The mod_imap module in Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61, and the mod_imagemap module in 2.2.0 through 2.2.6, are vulnerable to cross-site scripting via unspecified vectors. An attacker can inject arbitrary web script or HTML into a response, which matters because it can be used to hijack sessions or deface pages served by the affected server.
Impact
An attacker can execute script in the context of a victim's browser session against the affected site, enabling session theft, credential phishing, or content manipulation. The CVSS 2.0 vector shows partial integrity impact only, with no confidentiality or availability impact.
Attack surface
The flaw is reachable remotely over the network (AV:N) with no authentication required (Au:N), but the CVSS vector indicates medium attack complexity (AC:M), suggesting some precondition or non-default configuration is needed. The description does not specify the exact request or parameter, so the precise trigger is unknown.
Exploitation
CVE-2007-5000 is not listed in CISA KEV and has no ransomware associations; EPSS shows a 30-day probability of 0.46603 (98.8th percentile), indicating elevated predicted activity, but the references contain only vendor advisories and third-party bulletins, with no public exploit or PoC tagged.
What to do
- Upgrade Apache HTTP Server to a release later than the affected ranges (1.3.39, 2.0.61, 2.2.6) per the vendor advisories.
- If mod_imap or mod_imagemap is not required, disable or remove the module to eliminate the attack surface.
- Apply the distribution vendor patches for Fedora, Ubuntu, openSUSE/SUSE, and Oracle products listed in the record.
- Add output encoding or input validation for any user-supplied data reaching the imap/imagemap handlers if the module must remain enabled.
Detection
- Inspect web server access logs for requests to imap or imagemap handler paths containing script tags, event handlers, or encoded HTML.
- Review HTTP responses from mod_imap/mod_imagemap endpoints for reflected unescaped input.
- Monitor for anomalous client-side script execution or referrer patterns associated with XSS against the affected server.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
7 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-5000 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-5000), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
