{"api_version":"1","generated_at":"2026-07-23T10:23:09+00:00","cve":"CVE-2008-2637","urls":{"html":"https://cve.report/CVE-2008-2637","api":"https://cve.report/api/cve/CVE-2008-2637.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-2637","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-2637"},"summary":{"title":"CVE-2008-2637","description":"Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in (1) the css_exceptions parameter in vdesk/admincon/webyfiers.php and (2) the sql_matchscope parameter in vdesk/admincon/index.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-06-10 00:32:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2008/1765/references","name":"http://www.vupen.com/english/advisories/2008/1765/references","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1020205","name":"http://www.securitytracker.com/id?1020205","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - F5 FirePass Input Validation Hole in 'css_exceptions' and 'sql_matchscope' Parameters Permits Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/493149/100/0/threaded","name":"http://www.securityfocus.com/archive/1/493149/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42884","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42884","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/3931","name":"http://securityreason.com/securityalert/3931","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityReason - F5 FirePass Content Inspection Management XSS","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/30550","name":"http://secunia.com/advisories/30550","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"F5 FirePass SSL VPN Appliance Cross-Site Scripting Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/29574","name":"http://www.securityfocus.com/bid/29574","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"F5 FirePass SSL VPN Multiple Cross-Site Request Forgery Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2637","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2637","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"2637","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"f5","cpe5":"firepass_ssl_vpn","cpe6":"6.0.2","cpe7":"hotfix_3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T09:05:30.281Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1020205","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1020205"},{"name":"ADV-2008-1765","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/1765/references"},{"name":"20080605 F5 FirePass Content Inspection Management XSS","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/493149/100/0/threaded"},{"name":"30550","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30550"},{"name":"3931","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/3931"},{"name":"29574","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/29574"},{"name":"firepass-webyfiers-index-xss(42884)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42884"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-06-05T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in (1) the css_exceptions parameter in vdesk/admincon/webyfiers.php and (2) the sql_matchscope parameter in vdesk/admincon/index.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-11T19:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"1020205","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1020205"},{"name":"ADV-2008-1765","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/1765/references"},{"name":"20080605 F5 FirePass Content Inspection Management XSS","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/493149/100/0/threaded"},{"name":"30550","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30550"},{"name":"3931","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/3931"},{"name":"29574","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/29574"},{"name":"firepass-webyfiers-index-xss(42884)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42884"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-2637","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in (1) the css_exceptions parameter in vdesk/admincon/webyfiers.php and (2) the sql_matchscope parameter in vdesk/admincon/index.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1020205","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1020205"},{"name":"ADV-2008-1765","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/1765/references"},{"name":"20080605 F5 FirePass Content Inspection Management XSS","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/493149/100/0/threaded"},{"name":"30550","refsource":"SECUNIA","url":"http://secunia.com/advisories/30550"},{"name":"3931","refsource":"SREASON","url":"http://securityreason.com/securityalert/3931"},{"name":"29574","refsource":"BID","url":"http://www.securityfocus.com/bid/29574"},{"name":"firepass-webyfiers-index-xss(42884)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42884"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-2637","datePublished":"2008-06-10T00:00:00.000Z","dateReserved":"2008-06-09T00:00:00.000Z","dateUpdated":"2024-08-07T09:05:30.281Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-06-10 00:32:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:f5:firepass_ssl_vpn:6.0.2:hotfix_3:*:*:*:*:*:*","matchCriteriaId":"40A7BB18-7A3D-4EB3-9878-78F52E17ADBA"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"2637","Ordinal":"1","Title":"CVE-2008-2637","CVE":"CVE-2008-2637","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"2637","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in (1) the css_exceptions parameter in vdesk/admincon/webyfiers.php and (2) the sql_matchscope parameter in vdesk/admincon/index.php.","Type":"Description","Title":"CVE-2008-2637"},{"CveYear":"2008","CveId":"2637","Ordinal":"2","NoteData":"2008-06-09","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"2637","Ordinal":"3","NoteData":"2018-10-11","Type":"Other","Title":"Modified"}]}}}