PT-2008-1883 · Sun · Sun Java System Identity Manager
Published
2008-01-11
·
Updated
2018-10-15
·
CVE-2008-0239
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Sun Java System Identity Manager versions 6.0 SP1 through 7.1
Description
The issue allows remote attackers to inject arbitrary HTML or web script via specific parameters to certain API endpoints, including the
cntry or lang parameters to "/idm/login.jsp", the resultsForm parameter to "/idm/account/findForSelect.jsp", or the activeControl parameter to "/idm/user/main.jsp".Recommendations
For Sun Java System Identity Manager versions 6.0 SP1 through 7.1, consider disabling access to the vulnerable API endpoints "/idm/login.jsp", "/idm/account/findForSelect.jsp", and "/idm/user/main.jsp" until a patch is available. Restrict the use of parameters
cntry, lang, resultsForm, and activeControl in these endpoints to minimize the risk of exploitation.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sun Java System Identity Manager