$ cve CVE-2008-0239 JSON

CVE-2008-0239 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 5.7% (pctl 93)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to inject arbitrary HTML or web script via the (1) cntry or lang parameters to /idm/login.jsp, (2) resultsForm parameter to /idm/account/findForSelect.jsp, or (3) activeControl parameter to /idm/user/main.jsp.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	5.7% — more likely to be exploited than 93% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2008-01-11
Last modified	2026-06-16

Affected (1)

Vendor	Product
sun	java system identity manager

Public exploits

Source	Title	Date
exploit-db	Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/login.jsp' Multiple Cross-Site Scripting Vulnerabilities	2008-01-09
exploit-db	Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/account/findForSelect.jsp?resultsForm' Cross-Site Scripting	2008-01-09
exploit-db	Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/user/main.jsp?activeControl' Cross-Site Scripting	2008-01-09

References

→ the Explorer · watch your stack · NVD