PT-2008-1884

CVE-2008-0240

Publicado

2008-01-11

Atualizado

2018-10-15

Descrição por

CVSS 2.0

4.3

Média

MétricasAV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager versions 6.0 SP1 through 7.1

Description The issue allows remote attackers to inject frames from arbitrary web sites and conduct phishing attacks via the helpUrl parameter. This is related to the /idm/help/index.jsp endpoint.

Recommendations For Sun Java System Identity Manager versions 6.0 SP1 through 7.1, consider restricting access to the /idm/help/index.jsp endpoint to minimize the risk of exploitation. Avoid using the helpUrl parameter in this endpoint until the issue is resolved.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Adrian Pastor

Jan Fry

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Identificadores relacionados