PT-2008-6261 · Sun · Sun Java System Identity Manager

Published 2008-11-18 · Updated 2018-10-11 · CVE-2008-5115

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager versions 6.0 through 6.0 SP4 Sun Java System Identity Manager version 7.0 Sun Java System Identity Manager version 7.1

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that update the password via the "idm/admin/changeself.jsp" endpoint.

Recommendations For Sun Java System Identity Manager versions 6.0 through 6.0 SP4, consider restricting access to the "idm/admin/changeself.jsp" endpoint until a fix is available. For Sun Java System Identity Manager version 7.0, consider restricting access to the "idm/admin/changeself.jsp" endpoint until a fix is available. For Sun Java System Identity Manager version 7.1, consider restricting access to the "idm/admin/changeself.jsp" endpoint until a fix is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-5115

Affected Products

Sun Java System Identity Manager

References · 11

• 🔥 https://exploit-db.com/exploits/32579 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5115 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-243386-1 · Vendor Advisory
• http://secunia.com/advisories/32606 · Vendor Advisory
• http://securityfocus.com/bid/32262 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46553 · Note
• http://securitytracker.com/id?1021170 · Note
• http://vupen.com/english/advisories/2008/3128 · Note
• http://procheckup.com/vulnerability_manager/vulnerabilities/pr07-11 · Note
• http://securityfocus.com/archive/1/498479/100/0/threaded · Note
• http://osvdb.org/49766 · Note