{"api_version":"1","generated_at":"2026-07-23T07:06:18+00:00","cve":"CVE-2008-2852","urls":{"html":"https://cve.report/CVE-2008-2852","api":"https://cve.report/api/cve/CVE-2008-2852.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-2852","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-2852"},"summary":{"title":"CVE-2008-2852","description":"Cross-site scripting (XSS) vulnerability in CGIWrap before 4.1, when an Internet Explorer based browser is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to failure to set the charset in error messages.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-06-25 12:36:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://sourceforge.net/project/shownotes.php?group_id=8209&release_id=607349","name":"http://sourceforge.net/project/shownotes.php?group_id=8209&release_id=607349","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"CGIWrap download | SourceForge.net","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://cgiwrap.sourceforge.net/changes.html","name":"http://cgiwrap.sourceforge.net/changes.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CGIWrap - Change Log","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/30765","name":"http://secunia.com/advisories/30765","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"CGIWrap Error Message Charset Cross-Site Scripting Vulnerability - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/29811","name":"http://www.securityfocus.com/bid/29811","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CGIWrap Error Page Handling Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43176","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43176","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://jvn.jp/en/jp/JVN45389864/index.html","name":"http://jvn.jp/en/jp/JVN45389864/index.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"JVN#45389864 CGIWrap error page cross-site scripting vulnerability","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2852","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2852","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"2852","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"nathan_neulinger","cpe5":"cgiwrap","cpe6":"3.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"2852","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"nathan_neulinger","cpe5":"cgiwrap","cpe6":"3.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"2852","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"nathan_neulinger","cpe5":"cgiwrap","cpe6":"3.6.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"2852","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"nathan_neulinger","cpe5":"cgiwrap","cpe6":"3.6.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"2852","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"nathan_neulinger","cpe5":"cgiwrap","cpe6":"3.6.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"2852","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"nathan_neulinger","cpe5":"cgiwrap","cpe6":"3.6.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"2852","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"nathan_neulinger","cpe5":"cgiwrap","cpe6":"3.6.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"2852","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"nathan_neulinger","cpe5":"cgiwrap","cpe6":"3.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"2852","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"nathan_neulinger","cpe5":"cgiwrap","cpe6":"4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T09:14:14.991Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"29811","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/29811"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://cgiwrap.sourceforge.net/changes.html"},{"name":"JVN#45389864","tags":["third-party-advisory","x_refsource_JVN","x_transferred"],"url":"http://jvn.jp/en/jp/JVN45389864/index.html"},{"name":"30765","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30765"},{"name":"cgiwrap-error-messages-xss(43176)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43176"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://sourceforge.net/project/shownotes.php?group_id=8209&release_id=607349"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-06-16T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in CGIWrap before 4.1, when an Internet Explorer based browser is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to failure to set the charset in error messages."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"29811","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/29811"},{"tags":["x_refsource_CONFIRM"],"url":"http://cgiwrap.sourceforge.net/changes.html"},{"name":"JVN#45389864","tags":["third-party-advisory","x_refsource_JVN"],"url":"http://jvn.jp/en/jp/JVN45389864/index.html"},{"name":"30765","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30765"},{"name":"cgiwrap-error-messages-xss(43176)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43176"},{"tags":["x_refsource_CONFIRM"],"url":"http://sourceforge.net/project/shownotes.php?group_id=8209&release_id=607349"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-2852","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in CGIWrap before 4.1, when an Internet Explorer based browser is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to failure to set the charset in error messages."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"29811","refsource":"BID","url":"http://www.securityfocus.com/bid/29811"},{"name":"http://cgiwrap.sourceforge.net/changes.html","refsource":"CONFIRM","url":"http://cgiwrap.sourceforge.net/changes.html"},{"name":"JVN#45389864","refsource":"JVN","url":"http://jvn.jp/en/jp/JVN45389864/index.html"},{"name":"30765","refsource":"SECUNIA","url":"http://secunia.com/advisories/30765"},{"name":"cgiwrap-error-messages-xss(43176)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43176"},{"name":"http://sourceforge.net/project/shownotes.php?group_id=8209&release_id=607349","refsource":"CONFIRM","url":"http://sourceforge.net/project/shownotes.php?group_id=8209&release_id=607349"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-2852","datePublished":"2008-06-25T10:00:00.000Z","dateReserved":"2008-06-24T00:00:00.000Z","dateUpdated":"2024-08-07T09:14:14.991Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-06-25 12:36:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nathan_neulinger:cgiwrap:3.5:*:*:*:*:*:*:*","matchCriteriaId":"D350D018-07DF-41BD-8358-B7FEE42D04D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:nathan_neulinger:cgiwrap:3.6:*:*:*:*:*:*:*","matchCriteriaId":"19D94994-FDE9-47FF-A247-0AF138828C50"},{"vulnerable":true,"criteria":"cpe:2.3:a:nathan_neulinger:cgiwrap:3.6.1:*:*:*:*:*:*:*","matchCriteriaId":"FCD73F47-CCA9-4E21-B631-CFB532D7816A"},{"vulnerable":true,"criteria":"cpe:2.3:a:nathan_neulinger:cgiwrap:3.6.2:*:*:*:*:*:*:*","matchCriteriaId":"6E64BEE1-0F96-41A2-8AD7-4889EFABF098"},{"vulnerable":true,"criteria":"cpe:2.3:a:nathan_neulinger:cgiwrap:3.6.3:*:*:*:*:*:*:*","matchCriteriaId":"00F89A6C-FA37-4BCA-B67D-C0CADC7470DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:nathan_neulinger:cgiwrap:3.6.4:*:*:*:*:*:*:*","matchCriteriaId":"894D89D7-966C-4709-BE5C-21C0CEC31D67"},{"vulnerable":true,"criteria":"cpe:2.3:a:nathan_neulinger:cgiwrap:3.6.10:*:*:*:*:*:*:*","matchCriteriaId":"A860C7A8-D4BE-43D8-9BD0-039C5CE494BB"},{"vulnerable":true,"criteria":"cpe:2.3:a:nathan_neulinger:cgiwrap:3.7:*:*:*:*:*:*:*","matchCriteriaId":"4A2CD755-9727-4762-ADE2-74B67DEFB52F"},{"vulnerable":true,"criteria":"cpe:2.3:a:nathan_neulinger:cgiwrap:4.0:*:*:*:*:*:*:*","matchCriteriaId":"6FFCFA04-FE7C-4DB0-911A-2CD7B61C2625"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"2852","Ordinal":"1","Title":"CVE-2008-2852","CVE":"CVE-2008-2852","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"2852","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in CGIWrap before 4.1, when an Internet Explorer based browser is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to failure to set the charset in error messages.","Type":"Description","Title":"CVE-2008-2852"},{"CveYear":"2008","CveId":"2852","Ordinal":"2","NoteData":"2008-06-25","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"2852","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}