CVE-2008-2929 Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface in Red Hat Directory Serve...
MediumCVSS 4.3
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject arbitrary web script or HTML via input values that use % (percent) escaping.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fedora directory server | All versions | No fix listed |
| redhat directory server | = 7.1-sp1 | No fix listed |
| redhat directory server | = 7.1-sp2 | No fix listed |
| redhat directory server | = 7.1-sp3 | No fix listed |
| redhat directory server | = 7.1-sp4 | No fix listed |
| redhat directory server | = 7.1-sp5 | No fix listed |
| redhat directory server | = 7.1-sp6 | No fix listed |
| redhat directory server | = 8.0-el4 | No fix listed |
| redhat directory server | = 8.0-el5 | No fix listed |
References
- SSRT080113 vendor-advisory
- 31565 third-party-advisory
- 31612 third-party-advisory
- 31702 third-party-advisory
- 31777 third-party-advisory
- 1020772 vdb-entry
- www.redhat.com patch
- 30870 patch vdb-entry
- ADV-2008-2480 vdb-entry
- bugzilla.redhat.com
- rhds-dsgw-dsae-xss(44737) vdb-entry
- oval:org.mitre.oval:def:5877 signature vdb-entry
- RHSA-2008:0596 vendor-advisory
- RHSA-2008:0601 vendor-advisory
- FEDORA-2008-7642 vendor-advisory
- FEDORA-2008-7339 vendor-advisory