{"api_version":"1","generated_at":"2026-07-23T14:50:53+00:00","cve":"CVE-2008-2462","urls":{"html":"https://cve.report/CVE-2008-2462","api":"https://cve.report/api/cve/CVE-2008-2462.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-2462","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-2462"},"summary":{"title":"CVE-2008-2462","description":"Cross-site scripting (XSS) vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter.","state":"PUBLISHED","assigner":"certcc","published_at":"2008-06-30 22:41:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2008/1930/references","name":"http://www.vupen.com/english/advisories/2008/1930/references","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43367","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43367","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/305208","name":"http://www.kb.cert.org/vuls/id/305208","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"],"title":"US-CERT Vulnerability Note VU#305208","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1020372","name":"http://www.securitytracker.com/id?1020372","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"SecurityTracker: Caucho Resin Input Validation Hole in the 'viewfile' Command Permits Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.caucho.com/resin/changes/changes-31.xtp#3.1.4%20-%20Dec%205%2C%202007","name":"http://www.caucho.com/resin/changes/changes-31.xtp#3.1.4%20-%20Dec%205%2C%202007","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Resin Change Log","mime":"text/xml","httpstatus":"404","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/29948","name":"http://www.securityfocus.com/bid/29948","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Caucho Technology Resin Viewfile 'file' Parameter Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/30845","name":"http://secunia.com/advisories/30845","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Caucho Resin \"file\" Cross-Site Scripting Vulnerability - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.caucho.com/resin/changes/changes-31.xtp#3.1.4%20-%20Dec%205,%202007","name":"CONFIRM:http://www.caucho.com/resin/changes/changes-31.xtp#3.1.4%20-%20Dec%205,%202007","refsource":"MITRE","tags":[],"title":"Resin Change Log","mime":"text/xml","httpstatus":"404","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2462","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2462","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"2462","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"caucho","cpe5":"resin","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T09:05:29.658Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"ADV-2008-1930","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/1930/references"},{"name":"VU#305208","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/305208"},{"name":"1020372","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1020372"},{"name":"caucho-resin-file-xss(43367)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43367"},{"name":"29948","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/29948"},{"name":"30845","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30845"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.caucho.com/resin/changes/changes-31.xtp#3.1.4%20-%20Dec%205%2C%202007"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-06-25T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"37e5125f-f79b-445b-8fad-9564f167944b","shortName":"certcc"},"references":[{"name":"ADV-2008-1930","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/1930/references"},{"name":"VU#305208","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/305208"},{"name":"1020372","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1020372"},{"name":"caucho-resin-file-xss(43367)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43367"},{"name":"29948","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/29948"},{"name":"30845","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30845"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.caucho.com/resin/changes/changes-31.xtp#3.1.4%20-%20Dec%205%2C%202007"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cert@cert.org","ID":"CVE-2008-2462","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"ADV-2008-1930","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/1930/references"},{"name":"VU#305208","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/305208"},{"name":"1020372","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1020372"},{"name":"caucho-resin-file-xss(43367)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43367"},{"name":"29948","refsource":"BID","url":"http://www.securityfocus.com/bid/29948"},{"name":"30845","refsource":"SECUNIA","url":"http://secunia.com/advisories/30845"},{"name":"http://www.caucho.com/resin/changes/changes-31.xtp#3.1.4%20-%20Dec%205,%202007","refsource":"CONFIRM","url":"http://www.caucho.com/resin/changes/changes-31.xtp#3.1.4%20-%20Dec%205,%202007"}]}}}},"cveMetadata":{"assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","assignerShortName":"certcc","cveId":"CVE-2008-2462","datePublished":"2008-06-30T22:00:00.000Z","dateReserved":"2008-05-28T00:00:00.000Z","dateUpdated":"2024-08-07T09:05:29.658Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-06-30 22:41:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:caucho:resin:*:*:*:*:*:*:*:*","versionEndExcluding":"3.0.25","matchCriteriaId":"79A3FAAD-1AAA-435A-815F-010D7310BAF3"},{"vulnerable":true,"criteria":"cpe:2.3:a:caucho:resin:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1.0","versionEndExcluding":"3.1.4","matchCriteriaId":"DB11056E-BDF0-406F-ACA6-BD143A193232"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"2462","Ordinal":"1","Title":"CVE-2008-2462","CVE":"CVE-2008-2462","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"2462","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter.","Type":"Description","Title":"CVE-2008-2462"},{"CveYear":"2008","CveId":"2462","Ordinal":"2","NoteData":"2008-06-30","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"2462","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}