CVE-2008-4918

23Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendepss 6.4%

da publicação à arma0 dias

Publicada no NVD4 de nov.

1ª PoC30 de out.

probabilidade de exploração

6.4%top 7% das CVEs

exploração observada

nãonenhuma fonte reporta

1 exploit(s) público(s)

Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering, which is not properly handled in the CFS block page, aka "universal website hijacking."

Produtos afetados

n/a · n/a

PoCs públicas encontradas — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/32552

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Referências

http://secunia.com/advisories/32498 http://securityreason.com/securityalert/4556 https://exchange.xforce.ibmcloud.com/vulnerabilities/46232 http://www.gnucitizen.org/blog/new-technique-to-perform-universal-website-hijacking/http://www.securityfocus.com/archive/1/497948/100/0/threaded http://www.securityfocus.com/archive/1/497958/100/0/threaded http://www.securityfocus.com/archive/1/497968/100/0/threaded http://www.securityfocus.com/archive/1/497989/100/0/threaded http://www.securityfocus.com/archive/1/498043/100/0/threaded http://www.securityfocus.com/archive/1/498073/100/0/threaded http://www.securityfocus.com/bid/31998 http://www.sonicwall.com/downloads/SonicOS_Enhanced_4.0.1.1_Release_Notes.pdf