CVE-2008-2929

2008-08-2918:41:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2008-2929

cross-site scripting

xss

red hat directory server

vulnerabilities

nvd

adminutil library

directory server administration express

dsgw

web interface

fedora directory server

remote attackers

5.5 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

70.2%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject arbitrary web script or HTML via input values that use % (percent) escaping.

CPENameOperatorVersion
redhat:directory_serverredhat directory servereq8.0
redhat:directory_serverredhat directory servereq7.1
fedora:directory_serverfedora directory servereq*

CPE	Name	Operator	Version
redhat:directory_server	redhat directory server	eq	8.0
redhat:directory_server	redhat directory server	eq	7.1
fedora:directory_server	fedora directory server	eq	*