Vulnerability record · CVE-2007-6388 · published 8 January 2008
CVE-2007-6388: Apache HTTP Server mod_status server-status page XSS
Apache · Http Server
mod_status in Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39 does not properly sanitize input when the server-status page is enabled, allowing reflected cross-site scripting. An attacker who can lure a victim to a crafted URL can execute script in the context of the affected server's origin.
Description
Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
AV:N/AC:M/Au:N/C:N/I:P/A:N
Automated analysis
medium priorityThe CVSS 2.0 score is 4.3 (medium) and impact is limited to integrity, but the high EPSS probability and broad installed base of affected Apache versions warrant attention.
What it is
mod_status in Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39 does not properly sanitize input when the server-status page is enabled, allowing reflected cross-site scripting. An attacker who can lure a victim to a crafted URL can execute script in the context of the affected server's origin.
Impact
An attacker can execute arbitrary script or HTML in a victim's browser session against the server-status origin, enabling session theft, credential phishing, or defacement of the status page. The flaw affects integrity only; no confidentiality or availability impact is recorded in the CVSS vector.
Attack surface
Reachable over the network via HTTP requests to the server-status page when mod_status and the status page are enabled. No authentication is required per the CVSS vector (Au:N), but the victim must interact with a crafted link or page (AC:M).
Exploitation
Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.75891, 99.5th percentile), but the references are advisories and vendor pages only, with no public exploit tag.
What to do
- Upgrade Apache HTTP Server to a release later than the affected ranges (2.2.6, 2.0.61, 1.3.39) per the vendor security pages.
- Disable mod_status or restrict the server-status page to trusted management networks only.
- Require authentication and IP allowlisting for any exposed server-status endpoint.
- Apply output encoding or input sanitization to server-status content if the module must remain enabled.
- Review distribution and third-party vendor advisories (Apple, openSUSE, VMware) for their patched builds.
Detection
- Search web access logs for requests to /server-status containing script tags, event handlers, or encoded HTML in query strings or paths.
- Monitor for anomalous referrers or repeated requests to the server-status page from external clients.
- Audit Apache configuration to confirm whether mod_status is loaded and whether the status page is publicly reachable.
- Inspect HTTP responses from server-status for reflected user input that is not HTML-encoded.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-6388 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-6388), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
