{"api_version":"1","generated_at":"2026-07-23T04:54:41+00:00","cve":"CVE-2008-0239","urls":{"html":"https://cve.report/CVE-2008-0239","api":"https://cve.report/api/cve/CVE-2008-0239.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-0239","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-0239"},"summary":{"title":"CVE-2008-0239","description":"Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to inject arbitrary HTML or web script via the (1) cntry or lang parameters to /idm/login.jsp, (2) resultsForm parameter to /idm/account/findForSelect.jsp, or (3) activeControl parameter to /idm/user/main.jsp.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-01-11 22:46:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.procheckup.com/Vulnerability_PR07-09.php","name":"http://www.procheckup.com/Vulnerability_PR07-09.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"ProCheckUp - Security Vulnerabilities 2007","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://secunia.com/advisories/28356","name":"http://secunia.com/advisories/28356","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Sun Java System Identity Manager Cross-Site Scripting Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/486076/100/0/threaded","name":"http://www.securityfocus.com/archive/1/486076/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.procheckup.com/Vulnerability_PR07-08.php","name":"http://www.procheckup.com/Vulnerability_PR07-08.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch"],"title":"ProCheckUp - Security Vulnerabilities 2007","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/27214","name":"http://www.securityfocus.com/bid/27214","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Sun Java System Identity Manager Multiple Input Validation Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1","name":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"#103180: Multiple Security Vulnerabilities in the Sun Java System Identity Manager May Allow HTML Injection, Cross-Site Scripting Exploits or Unauthorized Redirection","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39583","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39583","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39582","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39582","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39581","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39581","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39580","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39580","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.procheckup.com/Vulnerability_PR07-07.php","name":"http://www.procheckup.com/Vulnerability_PR07-07.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch"],"title":"ProCheckUp - Security Vulnerabilities 2007","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-200558-1","name":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-200558-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"http://securityreason.com/securityalert/3535","name":"http://securityreason.com/securityalert/3535","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Several XSS, Cross-domain Redirection and Frame Injection on Sun Java System Identity Manager - SecurityReason.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1019175","name":"http://www.securitytracker.com/id?1019175","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - Sun Java System Identity Manager Input Validation Hole Permits Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/0089","name":"http://www.vupen.com/english/advisories/2008/0089","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.procheckup.com/Vulnerability_PR07-06.php","name":"http://www.procheckup.com/Vulnerability_PR07-06.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch"],"title":"ProCheckUp - Security Vulnerabilities 2008","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-0239","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-0239","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"239","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sun","cpe5":"java_system_identity_manager","cpe6":"6.0","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"239","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sun","cpe5":"java_system_identity_manager","cpe6":"6.0","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"239","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sun","cpe5":"java_system_identity_manager","cpe6":"6.0","cpe7":"sp3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"239","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sun","cpe5":"java_system_identity_manager","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"239","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sun","cpe5":"java_system_identity_manager","cpe6":"7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T07:39:35.024Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20080110 PR07-06, PR07-07, PR07-08, PR07-09, PR07-10, PR07-12: Several XSS, Cross-domain Redirection and Frame Injection on Sun Java System Identity Manager","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/486076/100/0/threaded"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.procheckup.com/Vulnerability_PR07-07.php"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.procheckup.com/Vulnerability_PR07-06.php"},{"name":"103180","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred"],"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1"},{"name":"ADV-2008-0089","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/0089"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.procheckup.com/Vulnerability_PR07-08.php"},{"name":"28356","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/28356"},{"name":"3535","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/3535"},{"name":"1019175","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1019175"},{"name":"sun-identity-lang-xss(39581)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39581"},{"name":"200558","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred"],"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-200558-1"},{"name":"sun-identity-main-xss(39583)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39583"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.procheckup.com/Vulnerability_PR07-09.php"},{"name":"sun-identity-login-xss(39580)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39580"},{"name":"27214","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/27214"},{"name":"sun-identity-resultsform-xss(39582)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39582"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-01-10T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to inject arbitrary HTML or web script via the (1) cntry or lang parameters to /idm/login.jsp, (2) resultsForm parameter to /idm/account/findForSelect.jsp, or (3) activeControl parameter to /idm/user/main.jsp."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-15T20:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20080110 PR07-06, PR07-07, PR07-08, PR07-09, PR07-10, PR07-12: Several XSS, Cross-domain Redirection and Frame Injection on Sun Java System Identity Manager","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/486076/100/0/threaded"},{"tags":["x_refsource_MISC"],"url":"http://www.procheckup.com/Vulnerability_PR07-07.php"},{"tags":["x_refsource_MISC"],"url":"http://www.procheckup.com/Vulnerability_PR07-06.php"},{"name":"103180","tags":["vendor-advisory","x_refsource_SUNALERT"],"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1"},{"name":"ADV-2008-0089","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/0089"},{"tags":["x_refsource_MISC"],"url":"http://www.procheckup.com/Vulnerability_PR07-08.php"},{"name":"28356","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/28356"},{"name":"3535","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/3535"},{"name":"1019175","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1019175"},{"name":"sun-identity-lang-xss(39581)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39581"},{"name":"200558","tags":["vendor-advisory","x_refsource_SUNALERT"],"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-200558-1"},{"name":"sun-identity-main-xss(39583)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39583"},{"tags":["x_refsource_MISC"],"url":"http://www.procheckup.com/Vulnerability_PR07-09.php"},{"name":"sun-identity-login-xss(39580)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39580"},{"name":"27214","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/27214"},{"name":"sun-identity-resultsform-xss(39582)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39582"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-0239","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to inject arbitrary HTML or web script via the (1) cntry or lang parameters to /idm/login.jsp, (2) resultsForm parameter to /idm/account/findForSelect.jsp, or (3) activeControl parameter to /idm/user/main.jsp."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20080110 PR07-06, PR07-07, PR07-08, PR07-09, PR07-10, PR07-12: Several XSS, Cross-domain Redirection and Frame Injection on Sun Java System Identity Manager","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/486076/100/0/threaded"},{"name":"http://www.procheckup.com/Vulnerability_PR07-07.php","refsource":"MISC","url":"http://www.procheckup.com/Vulnerability_PR07-07.php"},{"name":"http://www.procheckup.com/Vulnerability_PR07-06.php","refsource":"MISC","url":"http://www.procheckup.com/Vulnerability_PR07-06.php"},{"name":"103180","refsource":"SUNALERT","url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1"},{"name":"ADV-2008-0089","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/0089"},{"name":"http://www.procheckup.com/Vulnerability_PR07-08.php","refsource":"MISC","url":"http://www.procheckup.com/Vulnerability_PR07-08.php"},{"name":"28356","refsource":"SECUNIA","url":"http://secunia.com/advisories/28356"},{"name":"3535","refsource":"SREASON","url":"http://securityreason.com/securityalert/3535"},{"name":"1019175","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1019175"},{"name":"sun-identity-lang-xss(39581)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39581"},{"name":"200558","refsource":"SUNALERT","url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-200558-1"},{"name":"sun-identity-main-xss(39583)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39583"},{"name":"http://www.procheckup.com/Vulnerability_PR07-09.php","refsource":"MISC","url":"http://www.procheckup.com/Vulnerability_PR07-09.php"},{"name":"sun-identity-login-xss(39580)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39580"},{"name":"27214","refsource":"BID","url":"http://www.securityfocus.com/bid/27214"},{"name":"sun-identity-resultsform-xss(39582)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39582"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-0239","datePublished":"2008-01-11T22:00:00.000Z","dateReserved":"2008-01-11T00:00:00.000Z","dateUpdated":"2024-08-07T07:39:35.024Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-01-11 22:46:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sun:java_system_identity_manager:6.0:sp1:*:*:*:*:*:*","matchCriteriaId":"D0C2964C-7435-4999-AF16-01CD9EF5782C"},{"vulnerable":true,"criteria":"cpe:2.3:a:sun:java_system_identity_manager:6.0:sp2:*:*:*:*:*:*","matchCriteriaId":"51CFF484-5A52-41DC-A003-A9319DF2AFB8"},{"vulnerable":true,"criteria":"cpe:2.3:a:sun:java_system_identity_manager:6.0:sp3:*:*:*:*:*:*","matchCriteriaId":"9A7E88DA-F3A8-4B0F-AD4F-8680C1FB3282"},{"vulnerable":true,"criteria":"cpe:2.3:a:sun:java_system_identity_manager:7.0:*:*:*:*:*:*:*","matchCriteriaId":"0980492E-B7DB-4B9F-A400-FDC47DB89A95"},{"vulnerable":true,"criteria":"cpe:2.3:a:sun:java_system_identity_manager:7.1:*:*:*:*:*:*:*","matchCriteriaId":"3A5C87C0-3734-4568-97A6-6AB8979AABE7"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"239","Ordinal":"1","Title":"CVE-2008-0239","CVE":"CVE-2008-0239","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"239","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to inject arbitrary HTML or web script via the (1) cntry or lang parameters to /idm/login.jsp, (2) resultsForm parameter to /idm/account/findForSelect.jsp, or (3) activeControl parameter to /idm/user/main.jsp.","Type":"Description","Title":"CVE-2008-0239"},{"CveYear":"2008","CveId":"239","Ordinal":"2","NoteData":"2008-01-11","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"239","Ordinal":"3","NoteData":"2018-10-15","Type":"Other","Title":"Modified"}]}}}