CVE-2008-2462 Cross-site scripting in n/a
Remote attackers can inject arbitrary web script or HTML via the file parameter in the viewfile documentation command, requiring user interaction to execute.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2008-2462?
CVE-2008-2462 is a medium-severity cross-site scripting vulnerability in n/a, published on 30 Jun 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site scripting (XSS) vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter.
Weakness: CWE-79
Which versions are affected by CVE-2008-2462?
It affects 1 product.
Products include Caucho Resin.
How do I fix CVE-2008-2462?
No fix has been published for CVE-2008-2462 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2008-2462 being exploited?
There is no known exploitation of CVE-2008-2462 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-44138 Path Traversal in Caucho Resin
- CVE-2012-2965 Caucho Quercus, as distributed in Resin, does not properly handle unspecified characters in the names of variables
- CVE-2012-2966 Caucho Quercus, as distributed in Resin, overwrites entries in SERVER superglobal array on basis of POST parameters
- CVE-2012-2967 Caucho Quercus, as distributed in Resin, does not properly implement the `==` operator for comparisons
- CVE-2012-2969 Path traversal in n/a
Sources
Also known as GHSA-h4x7-qwgf-wmph.