It is one of the bugs that you ask why it was never fixed, The "Apache mod_imagemap and mod_imap Cross-Site Scripting Vulnerability" was reported first on Dec 12th 2007 it was reported by Apache Software Foundation on 2008-03-19 to be in "Apache Software Foundation Apache 2.2.6" (refer to http://www.securityfocus.com/bid/26838) it is also found in these versions:
Apache Software Foundation Apache 2.2.5
Apache Software Foundation Apache 2.2.4
Apache Software Foundation Apache 2.2.3
Apache Software Foundation Apache 2.2.2
Apache Software Foundation Apache 2.2 .0
Apache Software Foundation Apache 2.0.59
Apache Software Foundation Apache 2.0.58
Apache Software Foundation Apache 2.0.56 -dev
Apache Software Foundation Apache 2.0.55
Apache Software Foundation Apache 2.0.54
Apache Software Foundation Apache 2.0.53
Apache Software Foundation Apache 2.0.52
Apache Software Foundation Apache 2.0.51
Apache Software Foundation Apache 2.0.50
Apache Software Foundation Apache 2.0.49
Apache Software Foundation Apache 2.0.48
Apache Software Foundation Apache 2.0.47
Apache Software Foundation Apache 2.0.46
Apache Software Foundation Apache 2.0.45
Apache Software Foundation Apache 2.0.44
Apache Software Foundation Apache 2.0.43
Apache Software Foundation Apache 2.0.42
Apache Software Foundation Apache 2.0.41
Apache Software Foundation Apache 2.0.40
Apache Software Foundation Apache 2.0.39
Apache Software Foundation Apache 2.0.38
Apache Software Foundation Apache 2.0.37
Apache Software Foundation Apache 2.0.36
Apache Software Foundation Apache 2.0.35
Apache Software Foundation Apache 2.0.32
Apache Software Foundation Apache 2.0.28 Beta
Apache Software Foundation Apache 2.0.28
Apache Software Foundation Apache 2.0 a9
Apache Software Foundation Apache 2.0
Apache Software Foundation Apache 1.3.39
Apache Software Foundation Apache 1.3.37
Apache Software Foundation Apache 1.3.36
Apache Software Foundation Apache 1.3.35
Apache Software Foundation Apache 1.3.34
Apache Software Foundation Apache 1.3.33
Apache Software Foundation Apache 1.3.32
Apache Software Foundation reported that they fixed the vulnerability in 2.2.7 but this version was never released because of flaws, so that 2.2.8 was released (see apache release notes). The vulnerabiltiy has not been tested for in 2.2.8.
Again, 2.2.8 is a update. the naming covention for Apache is kind of like windows OS's naming: Version.Service Pack.Update. Patch.