« Volver al listado

CVE-2008-1230

Estado: ModificadaAlta (9.3)—💥 Exploit

Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified manipulation that attaches a .jsp file to an "entry page."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Jspwiki — Jspwiki

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-1230",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-03-10T17:44:00.000",
  "references": [
    {
      "url": "http://marc.info/?l=bugtraq&m=120300554011544&w=2",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/28969",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.bugsec.com/articles.php?Security=48&Web-Application-Firewall=0",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/27785",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40511",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/5112",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=120300554011544&w=2",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28969",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.bugsec.com/articles.php?Security=48&Web-Application-Firewall=0",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/27785",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40511",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/5112",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified manipulation that attaches a .jsp file to an \"entry page.\""
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de subidas de archivos sin restringir en JSPWiki 2.4.104  y 2.5.139, permite a atacantes remotos subir y ejecutar archivos .jsp a través de una manipulación no especificada que adjunta el archivo .jsp a una \"entry page\"."
    }
  ],
  "lastModified": "2026-06-16T22:51:18.020",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jspwiki:jspwiki:2.4.104:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16A83901-3F2B-47D1-8D6E-A88A4F5427CD"
            },
            {
              "criteria": "cpe:2.3:a:jspwiki:jspwiki:2.5.139:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F4F141F-86C3-4A32-BC12-10BCB25501C3"
            },
            {
              "criteria": "cpe:2.3:a:jspwiki:jspwiki:2.5.139_beta:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0AAE134F-D5A8-4E2B-8EF4-6113867D63D6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "evaluatorSolution": "Reference links suggest possible solution upgrade to latest version (2.6.1) at:\r\nhttp://www.jspwiki.org/wiki/JSPWikiDownload"
}