CVE-2008-2462

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/30845Third Party Advisory
http://www.caucho.com/resin/changes/changes-31.xtp#3.1.4%20-%20Dec%205%2C%202007
http://www.kb.cert.org/vuls/id/305208Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/29948Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1020372Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2008/1930/referencesThird Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/43367Third Party Advisory, VDB Entry
http://secunia.com/advisories/30845Third Party Advisory
http://www.caucho.com/resin/changes/changes-31.xtp#3.1.4%20-%20Dec%205%2C%202007
http://www.kb.cert.org/vuls/id/305208Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/29948Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1020372Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2008/1930/referencesThird Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/43367Third Party Advisory, VDB Entry

Timeline

Published: Jun 30, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-24636.8The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Micro CVE-2008-24647.1The mld_input function in sys/netinet6/mld6.c in the kernel in NetBSD 4.0, FreeBSD, and KAME, when INET6 is enabled, allows remote attackers CVE-2008-246810.0Multiple buffer overflows in the QIP Server Service (aka qipsrvr.exe) in LANDesk Management Suite, Security Suite, and Server Manager 8.8 an CVE-2008-246910.0Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to exec CVE-2008-24709.3The InstallShield Update Service Agent ActiveX control in isusweb.dll allows remote attackers to cause a denial of service (memory corruptio CVE-2008-247410.0Buffer overflow in x87 before 3.5.5 in ABB Process Communication Unit 400 (PCU400) 4.4 through 4.6 allows remote attackers to execute arbitr CVE-2008-24759.3eBay Enhanced Picture Uploader ActiveX control (EPUWALcontrol.dll) before 1.0.27 allows remote attackers to execute arbitrary commands via t CVE-2008-24769.3The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 F CVE-2008-24777.5SQL injection vulnerability in index.php in MxBB (aka MX-System) Portal 2.7.3 allows remote attackers to execute arbitrary SQL commands via CVE-2008-24788.5scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privile CVE-2008-24796.8Multiple SQL injection vulnerabilities in phpFix 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) kind parameter to CVE-2008-248010.0PHP remote file inclusion vulnerability in plus.php in plusPHP Short URL Multi-User Script 1.6 allows remote attackers to execute arbitrary