CVE-2008-0240
Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/help/index.jsp?helpUrl' Remote Frame Injection
Severity Score
4.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
/idm/help/index.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to inject frames from arbitrary web sites and conduct phishing attacks via the helpUrl parameter, aka "frame injection."
El fichero /idm/help/index.jsp en Sun Java System Identity Manager 6.0 SP1 hasta SP3, 7.0, y 7.1 permite que atacantes remotos inyecten marcos desde cualquier sitio web, y lleven a cabo ataques de phising a través del parámetro helpUrl, también conocido como "inyección de marco".
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2008-01-09 First Exploit
- 2008-01-11 CVE Reserved
- 2008-01-11 CVE Published
- 2024-08-07 CVE Updated
- 2024-11-14 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://securityreason.com/securityalert/3535 | Third Party Advisory | |
| http://www.securityfocus.com/archive/1/486076/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/27214 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2008/0089 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/39586 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/31006 | 2008-01-09 | |
| http://www.procheckup.com/Vulnerability_PR07-10.php | 2024-08-07 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/28356 | 2018-10-15 | |
| http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1 | 2018-10-15 | |
| http://sunsolve.sun.com/search/document.do?assetkey=1-66-200558-1 | 2018-10-15 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Sun Search vendor "Sun" | Java System Identity Manager Search vendor "Sun" for product "Java System Identity Manager" | 6.0 Search vendor "Sun" for product "Java System Identity Manager" and version "6.0" | sp1 |
Affected
| ||||||
| Sun Search vendor "Sun" | Java System Identity Manager Search vendor "Sun" for product "Java System Identity Manager" | 6.0 Search vendor "Sun" for product "Java System Identity Manager" and version "6.0" | sp2 |
Affected
| ||||||
| Sun Search vendor "Sun" | Java System Identity Manager Search vendor "Sun" for product "Java System Identity Manager" | 6.0 Search vendor "Sun" for product "Java System Identity Manager" and version "6.0" | sp3 |
Affected
| ||||||
| Sun Search vendor "Sun" | Java System Identity Manager Search vendor "Sun" for product "Java System Identity Manager" | 7.0 Search vendor "Sun" for product "Java System Identity Manager" and version "7.0" | - |
Affected
| ||||||
| Sun Search vendor "Sun" | Java System Identity Manager Search vendor "Sun" for product "Java System Identity Manager" | 7.1 Search vendor "Sun" for product "Java System Identity Manager" and version "7.1" | - |
Affected
| ||||||