PT-2008-1884 · Sun · Sun Java System Identity Manager

Adrian Pastor + 1 · Publicado 2008-01-11 · Atualizado 2018-10-15 · CVE-2008-0240

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager versions 6.0 SP1 through 7.1

Description The issue allows remote attackers to inject frames from arbitrary web sites and conduct phishing attacks via the helpUrl parameter. This is related to the /idm/help/index.jsp endpoint.

Recommendations For Sun Java System Identity Manager versions 6.0 SP1 through 7.1, consider restricting access to the /idm/help/index.jsp endpoint to minimize the risk of exploitation. Avoid using the helpUrl parameter in this endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-0240

Produtos afetados

Sun Java System Identity Manager

Referências · 11

• 🔥 https://exploit-db.com/exploits/31006 · Exploit
• 🔥 http://procheckup.com/Vulnerability_PR07-10.php · Exploit
• http://vupen.com/english/advisories/2008/0089 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39586 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-200558-1 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-0240 · Nota de Segurança
• http://securityreason.com/securityalert/3535 · Nota
• http://securityfocus.com/bid/27214 · Nota
• http://secunia.com/advisories/28356 · Aviso do Fabricante
• http://securityfocus.com/archive/1/486076/100/0/threaded · Nota