CVE-2008-0241

MediumCVSS 5.8/10Last modified Jun 16, 2026

Description

Open redirect vulnerability in /idm/user/login.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the nextPage parameter.

Metrics

CVSS 2.0 5.8/10AV:N/AC:M/Au:N/C:N/I:P/A:P

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/28356Vendor Advisory
http://securityreason.com/securityalert/3535
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1Patch, Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200558-1Patch, Vendor Advisory
http://www.procheckup.com/Vulnerability_PR07-12.phpExploit, Patch
http://www.securityfocus.com/archive/1/486076/100/0/threaded
http://www.securityfocus.com/bid/27214
http://www.vupen.com/english/advisories/2008/0089Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/39590
http://secunia.com/advisories/28356Vendor Advisory
http://securityreason.com/securityalert/3535
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1Patch, Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200558-1Patch, Vendor Advisory
http://www.procheckup.com/Vulnerability_PR07-12.phpExploit, Patch
http://www.securityfocus.com/archive/1/486076/100/0/threaded
http://www.securityfocus.com/bid/27214
http://www.vupen.com/english/advisories/2008/0089Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/39590

Timeline

Published: Jan 11, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-02427.2Unspecified vulnerability in libdevinfo in Sun Solaris 10 allows local users to access files and gain privileges via unknown vectors, relate CVE-2008-02437.8Unspecified vulnerability in Lotus Domino 7.0.2 before Fix Pack 3 allows attackers to cause a denial of service via unknown vectors.CVE-2008-024410.0SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec CVE-2008-02457.5admin.php in UploadImage 1.0 does not check for the original password before making a change to a new password, which allows remote attacker CVE-2008-024610.0admin.php in UploadScript 1.0 does not check for the original password before making a change to a new password, which allows remote attacke CVE-2008-024710.0Heap-based buffer overflow in the Express Backup Server service (dsmsvc.exe) in IBM Tivoli Storage Manager (TSM) Express 5.3 before 5.3.7.3 CVE-2008-02489.3Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers to execute arbitrary c CVE-2008-02495.0PHP Webquest 2.6 allows remote attackers to retrieve database credentials via a direct request to admin/backup_phpwebquest.php, which leaks CVE-2008-02509.3Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a Studio Solution (.SLN)CVE-2008-025110.0Unrestricted file upload vulnerability in PhotoPost vBGallery before 2.4.2 allows remote attackers to upload and execute arbitrary files via CVE-2008-02527.5Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfil CVE-2008-02537.5SQL injection vulnerability in full_text.php in Binn SBuilder allows remote attackers to execute arbitrary SQL commands via the nid paramete