PT-2008-3927 · Caucho · Caucho Resin

Tomasz Kuczynski · Published 2008-06-30 · Updated 2018-10-31 · CVE-2008-2462

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Caucho Resin versions prior to 3.0.25 Caucho Resin versions 3.1.x prior to 3.1.4

Description: A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the file parameter in the viewfile documentation command.

Recommendations: For versions prior to 3.0.25, update to version 3.0.25 or later. For versions 3.1.x prior to 3.1.4, update to version 3.1.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-2462

Affected Products

Caucho Resin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2008-2462 · Security Note
• http://secunia.com/advisories/30845 · Note
• http://securitytracker.com/id?1020372 · Note
• http://vupen.com/english/advisories/2008/1930/references · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2462 · Note
• http://securityfocus.com/bid/29948 · Note
• http://caucho.com/resin/changes/changes-31.xtp#3.1.4%20-%20Dec%205%2C%202007 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43367 · Note
• http://kb.cert.org/vuls/id/305208 · Note