CVE-2008-4918

Опубликовано: 04 нояб. 2008

Источник: nvd

CVSS2: 4.3

EPSS Средний

Описание

Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering, which is not properly handled in the CFS block page, aka "universal website hijacking."

Ссылки

http://secunia.com/advisories/32498
Not Applicable
http://securityreason.com/securityalert/4556
Third Party Advisory
http://www.gnucitizen.org/blog/new-technique-to-perform-universal-website-hijacking/
Third Party Advisory
http://www.securityfocus.com/archive/1/497948/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/497958/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/497968/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/497989/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/498043/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/498073/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/31998
Third Party Advisory
VDB Entry
http://www.sonicwall.com/downloads/SonicOS_Enhanced_4.0.1.1_Release_Notes.pdf
Broken Link
http://www.vupen.com/english/advisories/2008/2970
Permissions Required
http://www.zerodayinitiative.com/advisories/ZDI-08-070
Third Party Advisory
VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-08-070/
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/46232
Third Party Advisory
VDB Entry
http://secunia.com/advisories/32498
Not Applicable
http://securityreason.com/securityalert/4556
Third Party Advisory
http://www.gnucitizen.org/blog/new-technique-to-perform-universal-website-hijacking/
Third Party Advisory
http://www.securityfocus.com/archive/1/497948/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/497958/100/0/threaded
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:sonicwall:sonicos_enhanced:*:*:*:*:*:*:*:*

Версия до 4.0.1.1 (исключая)

Одно из

cpe:2.3:h:sonicwall:pro_2040:-:*:*:*:*:*:*:*

cpe:2.3:h:sonicwall:tz_180:-:*:*:*:*:*:*:*

cpe:2.3:h:sonicwall:tz_190:-:*:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.25701

Средний

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-xp58-h76m-67p4

github

больше 3 лет назад