CVE-2008-1232
45Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 76%
from disclosure to weapon0 days
Published on NVDAug 4
1st PoCAug 1
exploitation probability
76%top 1% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Fixed
17 products (360 components)
Red Hat Enterprise Linux (v. 5 server) · Red Hat Enterprise Linux Desktop (v. 5 client) · Red Hat Enterprise Linux Desktop Workstation (v. 5 client) · Red Hat Certificate System 7.3 for 4AS · Red Hat Certificate System 7.3 for 4ES · and others 12
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Affected products
n/a · n/apublic PoCs found — 1✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/32138⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15/ca20090615-02-ca-service-desk-tomcat-cross-site-scripting-vulnerability.aspxhttp://lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.htmlhttp://marc.info/?l=bugtraq&m=123376588623823&w=2http://marc.info/?l=bugtraq&m=139344343412337&w=2http://secunia.com/advisories/31379http://secunia.com/advisories/31381http://secunia.com/advisories/31639http://secunia.com/advisories/31865http://secunia.com/advisories/31891http://secunia.com/advisories/31982