Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-0971 | First vendor Publication | 2008-12-19 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:S/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 3.5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 6.8 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in Barracuda Spam Firewall (BSF) before 3.5.12.007, Message Archiver before 1.2.1.002, Web Filter before 3.3.0.052, IM Firewall before 3.1.01.017, and Load Balancer before 2.3.024 allow remote attackers to inject arbitrary web script or HTML via (1) the Policy Name field in Search Based Retention Policy in Message Archiver; unspecified parameters in the (2) IP Configuration, (3) Administration, (4) Journal Accounts, (5) Retention Policy, and (6) GroupWise Sync components in Message Archiver; (7) input to search operations in Web Filter; and (8) input used in error messages and (9) hidden INPUT elements in (a) Spam Firewall, (b) IM Firewall, and (c) Web Filter. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0971 |
CAPEC : Common Attack Pattern Enumeration & Classification
| Id | Name |
|---|---|
| CAPEC-18 | Embedding Scripts in Nonscript Elements |
| CAPEC-19 | Embedding Scripts within Scripts |
| CAPEC-32 | Embedding Scripts in HTTP Query Strings |
| CAPEC-63 | Simple Script Injection |
| CAPEC-85 | Client Network Footprinting (using AJAX/XSS) |
| CAPEC-86 | Embedding Script (XSS ) in HTTP Headers |
| CAPEC-91 | XSS in IMG Tags |
| CAPEC-106 | Cross Site Scripting through Log Files |
| CAPEC-198 | Cross-Site Scripting in Error Pages |
| CAPEC-199 | Cross-Site Scripting Using Alternate Syntax |
| CAPEC-209 | Cross-Site Scripting Using MIME Type Mismatch |
| CAPEC-232 | Exploitation of Privilege/Trust |
| CAPEC-243 | Cross-Site Scripting in Attributes |
| CAPEC-244 | Cross-Site Scripting via Encoded URI Schemes |
| CAPEC-245 | Cross-Site Scripting Using Doubled Characters, e.g. %3C%3Cscript |
| CAPEC-246 | Cross-Site Scripting Using Flash |
| CAPEC-247 | Cross-Site Scripting with Masking through Invalid Characters in Identifiers |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 50709 | Barracuda Multiple Products index.cgi Unspecified Parameter XSS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2008-12-19 | Name : The remote web server contains CGI scripts that are affected by several issues. File : barracuda_spam_firewall_3_5_12_007.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:12:39 |
|
| 2024-11-28 12:14:59 |
|
| 2021-05-05 01:04:32 |
|
| 2021-05-04 12:07:10 |
|
| 2021-04-22 01:07:35 |
|
| 2020-05-23 01:39:09 |
|
| 2020-05-23 00:21:19 |
|
| 2018-10-16 05:18:10 |
|
| 2016-06-28 17:11:52 |
|
| 2016-04-26 17:09:34 |
|
| 2014-02-17 10:43:52 |
|
| 2013-05-11 00:10:12 |
|
