CVE-2008-0838

Sophos Es1000 - XSS

Title source: rule

Description

Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface in Sophos ES1000 and ES4000 Email Security Appliance 2.1.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) error and (2) go parameters to the login page.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Leon Juranic · textremotewindows

https://www.exploit-db.com/exploits/31204

View Code ZIP pw:eip

References (8)

[Vendor Advisory] http://secunia.com/advisories/28961

[Various Sources] http://www.infigo.hr/en/in_focus/advisories/INFIGO-2008-02-13

[Exploit] http://www.securityfocus.com/bid/27813

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1019427

[Various Sources] http://www.sophos.com/support/knowledgebase/article/34733.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/488206/100/0/threaded

[Third Party Advisory] http://www.vupen.com/english/advisories/2008/0574

[Third Party Advisory] http://securityreason.com/securityalert/3673

Scores

EPSS 0.1362

EPSS Percentile 94.1%

Classification

CWE

CWE-79

Status draft

Affected Products (2)

sophos/es1000

sophos/es4000

Timeline

Published Feb 20, 2008

Tracked Since Feb 18, 2026