PT-2008-4669 · Citrix+1 · Citrix Xenserver Express+4

Published 2008-07-22 · Updated 2017-08-08 · CVE-2008-3253

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Citrix XenServer Express version 4.1.0 Citrix XenServer Standard Edition version 4.1.0 Citrix XenServer Enterprise Edition version 4.1.0 Citrix XenServer Dell Edition (Express) version 4.1.0 Citrix XenServer Dell Edition (Enterprise) version 4.1.0 HP integrated Citrix XenServer (Select) version 4.1.0 HP integrated Citrix XenServer (Enterprise) version 4.1.0

Description: The issue is related to a cross-site scripting (XSS) vulnerability in the XenAPI HTTP interfaces. This allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Recommendations: For Citrix XenServer Express version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available. For Citrix XenServer Standard Edition version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available. For Citrix XenServer Enterprise Edition version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available. For Citrix XenServer Dell Edition (Express) version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available. For Citrix XenServer Dell Edition (Enterprise) version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available. For HP integrated Citrix XenServer (Select) version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available. For HP integrated Citrix XenServer (Enterprise) version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-3253

Affected Products

Citrix Xenserver Dell Edition

Citrix Xenserver Enterprise Edition

Citrix Xenserver Express

Citrix Xenserver Standard Edition

Hp Integrated Citrix Xenserver

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-3253 · Security Note
• http://secunia.com/advisories/31133 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3253 · Note
• http://securitytracker.com/id?1020515 · Note
• http://securityfocus.com/bid/30265 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43857 · Note
• http://vupen.com/english/advisories/2008/2117/references · Note
• http://support.citrix.com/article/CTX117814 · Note