CVE-2008-5266 Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 buil...
MediumCVSS 4.3
EPSS 5.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 build b04-fcs allows remote attackers to inject arbitrary web script or HTML via the name parameter, a different vector than CVE-2008-2751.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun java system application server | = 9.1_01-b09d-fcs | No fix listed |
| sun java system application server | = 9.1_02-b04-fcs | No fix listed |
| oracle glassfish server | = 2.0 | No fix listed |
References
- 30604 third-party-advisory vendor-advisory
- 4659 third-party-advisory
- webappsecurity.wordpress.com
- 20080610 XSS - Glassfish Web Admin Interface (Sun Java System Application Server 9.1_01 (build b09d-fcs) ) mailing-list
- 29646 vdb-entry
- glassfish-httplisteneredit-xss(47029) vdb-entry