CVE-2008-2168: Apache HTTP Server XSS in 403 error page via UTF-7 encoded URLs

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityReflected XSS with only partial integrity impact and no KEV listing, but a high EPSS score and public exploit reference raise the practical risk.

What it is

Apache HTTP Server 2.2.6 and earlier fails to properly handle UTF-7 encoded URLs when rendering the 403 Forbidden error page, allowing reflected cross-site scripting. An attacker can craft a URL that causes arbitrary script or HTML to be injected into the error page served to a victim.

Impact

An attacker can execute script in the context of the victim's browser session against the affected server's origin, enabling session theft, credential phishing, or page content manipulation. The CVSS 2.0 vector shows partial integrity impact only, with no confidentiality or availability impact.

Attack surface

Reached remotely over the network by luring a victim to a crafted UTF-7 encoded URL; no authentication is required, but the CVSS vector indicates medium access complexity and the XSS requires the victim to follow the link.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded. EPSS is high (0.54851, 98.975th percentile) and one reference carries an Exploit tag, indicating public exploit material exists.

What to do

• Upgrade Apache HTTP Server beyond 2.2.6 to a current supported release, or apply the vendor patch for this issue.
• Apply the relevant distribution updates referenced in the Ubuntu USN-731-1 and HP advisories if running those packaged builds.
• Encode or reject UTF-7 and other non-standard URL encodings in request handling and error page output.
• Deploy a WAF or reverse proxy rule that blocks script-bearing payloads in URLs that reach error pages.
• Set a restrictive Content-Security-Policy and correct Content-Type/charset headers on error responses to reduce script execution.

Detection

• Search web server access logs for requests containing UTF-7 markers such as '+ADw-' or '+ACc-' in the URL path or query string.
• Monitor 403 responses whose request URIs contain encoded script or HTML tags.
• Review proxy and WAF logs for repeated error-page requests from the same source with encoded payloads.
• Check for unexpected script content or inline event handlers in captured 403 error page responses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.