« Volver al listado

CVE-2008-3700

Estado: ModificadaMedia (4.3)—

Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite 3.20.02 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the sessionid parameter in a livesupport startclientchat action to visitor/index.php; (2) the filter parameter in a news view action to index.php; or the Full Name field in a (3) account creation, (4) ticket opening, or (5) chat request operation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Kayako — Supportsuite

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-3700",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-08-15T20:41:00.000",
  "references": [
    {
      "url": "http://forums.kayako.com/f3/3-30-00-stable-released-18304/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/47613",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/47614",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/47615",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/31431",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.gulftech.org/?node=research&article_id=00123-08092008",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/30642",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44382",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44383",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://forums.kayako.com/f3/3-30-00-stable-released-18304/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/47613",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/47614",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/47615",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/31431",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.gulftech.org/?node=research&article_id=00123-08092008",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/30642",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44382",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44383",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite 3.20.02 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the sessionid parameter in a livesupport startclientchat action to visitor/index.php; (2) the filter parameter in a news view action to index.php; or the Full Name field in a (3) account creation, (4) ticket opening, or (5) chat request operation."
    },
    {
      "lang": "es",
      "value": "Multiples vulnerabilidades de Secuencias de comandos en sitios cruzados (XSS) en versiones de Kayako SupportSuite 3.20.02 y anteriores, permiten a atacantes remotos inyectar scripts web o HTML arbitrarios a través de (1) el parámetro sessionid  en una acción livesupport startclientchat en visitor/index.php, (2) el parámetro filter en una accion de ver noticia en index.php, o el campo nombre completo en (3) la creación de la cuenta, (4) la apertura de tickets, o (5) una operación de petición de chat."
    }
  ],
  "lastModified": "2026-06-16T22:56:20.627",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3FDF164A-684F-4440-95BC-E9493DE860E5",
              "versionEndIncluding": "3.20.02"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.10.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9C022D3-42ED-442E-9125-E0EAA8E74705"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.10.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FC5A1D5-8831-4032-92D8-DD490CC28774"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.11.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "878901B9-06F2-49ED-A035-1BD86BB5F11D"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.11.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F297ABB-E65C-4BBF-B846-AFCC5A572540"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}