CVE-2008-5266 - Vulnerability Details - OpenCVE

Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 build b04-fcs allows remote attackers to inject arbitrary web script or HTML via the name parameter, a different vector than CVE-2008-2751.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Oracle	Glassfish Server
Sun	Java System Application Server

Configuration 1 [-]

AND

OR	cpe:2.3:a:sun:java_system_application_server:9.1_01:b09d-fcs::::::
	cpe:2.3:a:sun:java_system_application_server:9.1_02:b04-fcs::::::

cpe:2.3:a:oracle:glassfish_server:2.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://secunia.com/advisories/30604
http://securityreason.com/securityalert/4659
http://webappsecurity.wordpress.com/2008/06/11/xss-glassfish-web-admin-interface-sun-java-system-application/
http://www.securityfocus.com/archive/1/493243/100/0/threaded
http://www.securityfocus.com/bid/29646
https://exchange.xforce.ibmcloud.com/vulnerabilities/47029

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2008-11-28T18:26:00

Updated: 2024-08-07T10:49:12.065Z

Reserved: 2008-11-28T00:00:00

Link: CVE-2008-5266

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2008-11-28T19:00:08.360

Modified: 2025-04-09T00:30:58.490

Link: CVE-2008-5266

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-06-10T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 build b04-fcs allows remote attackers to inject arbitrary web script or HTML via the name parameter, a different vector than CVE-2008-2751."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "4659", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/4659"}, {"name": "20080610 XSS - Glassfish Web Admin Interface (Sun Java System Application Server 9.1_01 (build b09d-fcs) )", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/493243/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://webappsecurity.wordpress.com/2008/06/11/xss-glassfish-web-admin-interface-sun-java-system-application/"}, {"name": "glassfish-httplisteneredit-xss(47029)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47029"}, {"name": "30604", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/30604"}, {"name": "29646", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/29646"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-5266", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 build b04-fcs allows remote attackers to inject arbitrary web script or HTML via the name parameter, a different vector than CVE-2008-2751."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "4659", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/4659"}, {"name": "20080610 XSS - Glassfish Web Admin Interface (Sun Java System Application Server 9.1_01 (build b09d-fcs) )", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/493243/100/0/threaded"}, {"name": "http://webappsecurity.wordpress.com/2008/06/11/xss-glassfish-web-admin-interface-sun-java-system-application/", "refsource": "MISC", "url": "http://webappsecurity.wordpress.com/2008/06/11/xss-glassfish-web-admin-interface-sun-java-system-application/"}, {"name": "glassfish-httplisteneredit-xss(47029)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47029"}, {"name": "30604", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/30604"}, {"name": "29646", "refsource": "BID", "url": "http://www.securityfocus.com/bid/29646"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T10:49:12.065Z"}, "title": "CVE Program Container", "references": [{"name": "4659", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/4659"}, {"name": "20080610 XSS - Glassfish Web Admin Interface (Sun Java System Application Server 9.1_01 (build b09d-fcs) )", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/493243/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://webappsecurity.wordpress.com/2008/06/11/xss-glassfish-web-admin-interface-sun-java-system-application/"}, {"name": "glassfish-httplisteneredit-xss(47029)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47029"}, {"name": "30604", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/30604"}, {"name": "29646", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/29646"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-5266", "datePublished": "2008-11-28T18:26:00", "dateReserved": "2008-11-28T00:00:00", "dateUpdated": "2024-08-07T10:49:12.065Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sun:java_system_application_server:9.1_01:b09d-fcs:*:*:*:*:*:*", "matchCriteriaId": "4D4530B8-D1CC-4FCF-996B-65564B2543F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:sun:java_system_application_server:9.1_02:b04-fcs:*:*:*:*:*:*", "matchCriteriaId": "250D23D8-7897-4391-9B2B-278B2579DD1C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:glassfish_server:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "8C6AD5FD-8A44-4184-B5F5-9FC0DF24B475", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 build b04-fcs allows remote attackers to inject arbitrary web script or HTML via the name parameter, a different vector than CVE-2008-2751."}, {"lang": "es", "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en configuration/httpListenerEdit.jsf en la interfaz GlassFish 2 UR2 b04 webadmin en Sun Java System Application Server v9.1_01 build b09d-fcs y v9.1_02 build b04-fcs permite a atacantes remotos inyectar web script o HTML a trav\u00e9s del par\u00e1metro \"name\", un vector diferente a CVE-2008-2751."}], "id": "CVE-2008-5266", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2008-11-28T19:00:08.360", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/30604"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/4659"}, {"source": "cve@mitre.org", "url": "http://webappsecurity.wordpress.com/2008/06/11/xss-glassfish-web-admin-interface-sun-java-system-application/"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/493243/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/29646"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47029"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/30604"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/4659"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://webappsecurity.wordpress.com/2008/06/11/xss-glassfish-web-admin-interface-sun-java-system-application/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/493243/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/29646"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47029"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}