CVE-2008-0239

SUN Java System Identity Manager - XSS

Title source: rule

Description

Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to inject arbitrary HTML or web script via the (1) cntry or lang parameters to /idm/login.jsp, (2) resultsForm parameter to /idm/account/findForSelect.jsp, or (3) activeControl parameter to /idm/user/main.jsp.

Exploits (3)

exploitdb WORKING POC VERIFIED

by Jan Fry & Adrian Pastor · textwebappsjsp

https://www.exploit-db.com/exploits/31004

View Code ZIP pw:eip

exploitdb WRITEUP VERIFIED

by Jan Fry & Adrian Pastor · textwebappsjsp

https://www.exploit-db.com/exploits/31005

View Code ZIP pw:eip

exploitdb WRITEUP VERIFIED

by Jan Fry & Adrian Pastor · textwebappsjsp

https://www.exploit-db.com/exploits/31007

View Code ZIP pw:eip

References (16)

[Vendor Advisory] http://secunia.com/advisories/28356

[Vendor Advisory] http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1

[Vendor Advisory] http://sunsolve.sun.com/search/document.do?assetkey=1-66-200558-1

[Exploit, Patch] http://www.procheckup.com/Vulnerability_PR07-06.php

[Exploit, Patch] http://www.procheckup.com/Vulnerability_PR07-07.php

[Exploit, Patch] http://www.procheckup.com/Vulnerability_PR07-08.php

[Various Sources] http://www.procheckup.com/Vulnerability_PR07-09.php

[Exploit] http://www.securityfocus.com/bid/27214

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1019175

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/39580

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/39581

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/39582

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/39583

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/486076/100/0/threaded

[Third Party Advisory] http://www.vupen.com/english/advisories/2008/0089

[Third Party Advisory] http://securityreason.com/securityalert/3535

Scores

EPSS 0.0955

EPSS Percentile 92.7%

Classification

CWE

CWE-79

Status draft

Affected Products (5)

sun/java_system_identity_manager

sun/java_system_identity_manager

sun/java_system_identity_manager

sun/java_system_identity_manager

sun/java_system_identity_manager

Timeline

Published Jan 11, 2008

Tracked Since Feb 18, 2026