CVE-2008-4918
Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is…
Does this matter?
Lower severity and a low EPSS score (6.42%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering, which is not properly handled in the CFS block page, aka "universal website hijacking."
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 6.42% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- sonicwall/sonicos enhanced
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/32498Not Applicable
- http://securityreason.com/securityalert/4556Third Party Advisory
- http://www.gnucitizen.org/blog/new-technique-to-perform-universal-website-hijacking/Third Party Advisory
- http://www.securityfocus.com/archive/1/497948/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/497958/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/497968/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/497989/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/498043/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/498073/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/31998Third Party Advisory, VDB Entry
- http://www.sonicwall.com/downloads/SonicOS_Enhanced_4.0.1.1_Release_Notes.pdfBroken Link
- http://www.vupen.com/english/advisories/2008/2970Permissions Required
- http://www.zerodayinitiative.com/advisories/ZDI-08-070Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-08-070/Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46232Third Party Advisory, VDB Entry
- http://secunia.com/advisories/32498Not Applicable
- http://securityreason.com/securityalert/4556Third Party Advisory
- http://www.gnucitizen.org/blog/new-technique-to-perform-universal-website-hijacking/Third Party Advisory
- http://www.securityfocus.com/archive/1/497948/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/497958/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/497968/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/497989/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/498043/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/498073/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/31998Third Party Advisory, VDB Entry
- http://www.sonicwall.com/downloads/SonicOS_Enhanced_4.0.1.1_Release_Notes.pdfBroken Link
- http://www.vupen.com/english/advisories/2008/2970Permissions Required
- http://www.zerodayinitiative.com/advisories/ZDI-08-070Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-08-070/Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46232Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.