PT-2008-2456 · Sophos · Sophos Es1000 Email Security Appliance+1

Leon Juranic · Publicado 2008-02-20 · Atualizado 2018-10-15 · CVE-2008-0838

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sophos ES1000 and ES4000 Email Security Appliance version 2.1.0.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the web administration interface. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the error and go parameters to the "login page" API endpoint.

Recommendations For Sophos ES1000 and ES4000 Email Security Appliance version 2.1.0.0, as a temporary workaround, consider restricting access to the login page until a patch is available. Avoid using the error and go parameters in the login page API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-0838

Produtos afetados

Sophos Es1000 Email Security Appliance

Sophos Es4000 Email Security Appliance

Referências · 10

• 🔥 https://exploit-db.com/exploits/31204 · Exploit
• 🔥 http://securityfocus.com/bid/27813 · Exploit
• http://securityfocus.com/archive/1/488206/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0838 · Nota de Segurança
• http://sophos.com/support/knowledgebase/article/34733.html · Nota
• http://securityreason.com/securityalert/3673 · Nota
• http://securitytracker.com/id?1019427 · Nota
• http://vupen.com/english/advisories/2008/0574 · Nota
• http://secunia.com/advisories/28961 · Aviso do Fabricante
• http://infigo.hr/en/in_focus/advisories/INFIGO-2008-02-13 · Nota