PT-2008-1884

CVE-2008-0240

Published

2008-01-11

Updated

2018-10-15

Description by

CVSS 2.0

4.3

Medium

MetricsAV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager versions 6.0 SP1 through 7.1

Description The issue allows remote attackers to inject frames from arbitrary web sites and conduct phishing attacks via the helpUrl parameter. This is related to the /idm/help/index.jsp endpoint.

Recommendations For Sun Java System Identity Manager versions 6.0 SP1 through 7.1, consider restricting access to the /idm/help/index.jsp endpoint to minimize the risk of exploitation. Avoid using the helpUrl parameter in this endpoint until the issue is resolved.

Exploitability

Exploit

Fix

Impacts

Researchers

Adrian Pastor

Jan Fry

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers