PT-2008-1883 · Sun · Sun Java System Identity Manager
Publicado
2008-01-11
·
Atualizado
2018-10-15
·
CVE-2008-0239
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Sun Java System Identity Manager versions 6.0 SP1 through 7.1
Description
The issue allows remote attackers to inject arbitrary HTML or web script via specific parameters to certain API endpoints, including the
cntry or lang parameters to "/idm/login.jsp", the resultsForm parameter to "/idm/account/findForSelect.jsp", or the activeControl parameter to "/idm/user/main.jsp".Recommendations
For Sun Java System Identity Manager versions 6.0 SP1 through 7.1, consider disabling access to the vulnerable API endpoints "/idm/login.jsp", "/idm/account/findForSelect.jsp", and "/idm/user/main.jsp" until a patch is available. Restrict the use of parameters
cntry, lang, resultsForm, and activeControl in these endpoints to minimize the risk of exploitation.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Sun Java System Identity Manager