« Volver al listado

CVE-2008-2518

Estado: ModificadaMedia (4.3)—

Cross-site scripting (XSS) vulnerability in the advanced search mechanism (webapps/search/advanced.jsp) in Sun Java System Web Server 6.1 before SP9 and 7.0 before Update 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably related to the next parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SUN — Java System WEB Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-2518",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-06-03T14:32:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/30381",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-236481-1",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/29355",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1020110",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/1649/references",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42624",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/30381",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-236481-1",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/29355",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1020110",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/1649/references",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42624",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in the advanced search mechanism (webapps/search/advanced.jsp) in Sun Java System Web Server 6.1 before SP9 and 7.0 before Update 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably related to the next parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el mecanismo de búsqueda avanzada (webapps/search/advanced.jsp) de Sun Java System Web Server 6.1 versiones anteriores a SP9 y 7.0 versiones anteriores a  Update 3 permite a atacantes remotos inyectar web script o HTML a través de vectores no especificados, probablemente relacionados al parámetro next."
    }
  ],
  "lastModified": "2026-06-16T22:53:55.103",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sun:java_system_web_server:6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "044D96F6-7A18-4295-A665-16F1A6630963"
            },
            {
              "criteria": "cpe:2.3:a:sun:java_system_web_server:6.1:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85A181D1-C261-4C29-BC8C-A7A815A63E2E"
            },
            {
              "criteria": "cpe:2.3:a:sun:java_system_web_server:6.1:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A10F68F-4A2F-44A0-A039-1A34C6E2D083"
            },
            {
              "criteria": "cpe:2.3:a:sun:java_system_web_server:6.1:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "021DC080-18ED-41F4-9FBD-1DD0C332F871"
            },
            {
              "criteria": "cpe:2.3:a:sun:java_system_web_server:6.1:sp4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C878B2FD-88A1-44E2-9234-C40CA1DDC5BC"
            },
            {
              "criteria": "cpe:2.3:a:sun:java_system_web_server:6.1:sp5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BABE9BB1-E968-4EC9-A13A-6ECBCDC0D9AC"
            },
            {
              "criteria": "cpe:2.3:a:sun:java_system_web_server:6.1:sp6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6606659-59FE-4E17-9643-2267223DE6F8"
            },
            {
              "criteria": "cpe:2.3:a:sun:java_system_web_server:6.1:sp7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BC77D08-B591-4824-AC47-F14F4F53C63D"
            },
            {
              "criteria": "cpe:2.3:a:sun:java_system_web_server:6.1:sp8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F79805E6-ED7E-4BD1-9A2F-2D3B23B05981"
            },
            {
              "criteria": "cpe:2.3:a:sun:java_system_web_server:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFAA741F-6B77-44E5-8B84-AB5E49901BD1"
            },
            {
              "criteria": "cpe:2.3:a:sun:java_system_web_server:7.0:update_1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F44ABA9C-D281-4C9D-A313-013F82E5BFB8"
            },
            {
              "criteria": "cpe:2.3:a:sun:java_system_web_server:7.0:update_2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60712BCA-1AE2-4F19-B8EF-462A1F0BDED3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}