CVE-2008-7017 EXPLOIT
4.3
MEDIUM · CVSS 2.0 · EPSS 0.9% (pctl 59)
Patch early
A public exploit exists.
Description
Cross-site scripting (XSS) vulnerability in analyse.php in CAcert 20080921, and possibly other versions before 20080928, allows remote attackers to inject arbitrary web script or HTML via the CN (CommonName) field in the subject of an X.509 certificate.
Scoring
| CVSS | 4.3 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| EPSS | 0.9% — more likely to be exploited than 59% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-08-21 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| cacert | cacert |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | CAcert - 'analyse.php' Cross-Site Scripting | 2008-09-29 |
References
- http://www.cynops.de/advisories/AKLINK-SA-2008-007.txt
- http://www.securityfocus.com/bid/31481
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45515
- http://www.cynops.de/advisories/AKLINK-SA-2008-007.txt
- http://www.securityfocus.com/bid/31481
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45515
→ the Explorer · watch your stack · NVD