Unscored severity · published Feb 20, 2008
CVE-2008-0838
Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface in Sophos ES1000 and ES4000 Email Security Appliance 2.1.0.0 allow remote attackers to…
–
CVSS
4.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface in Sophos ES1000 and ES4000 Email Security Appliance 2.1.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) error and (2) go parameters to the login page.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.2% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Es1000 · Sophos
2.1.0.0 · source: NVD
ES
Es4000 · Sophos
2.1.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-0838
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-0838
Vendor Advisory
http://secunia.com/advisories/28961
securityreason.com
http://securityreason.com/securityalert/3673
www.infigo.hr
http://www.infigo.hr/en/in_focus/advisories/INFIGO-2008-02-13
www.securityfocus.com
http://www.securityfocus.com/archive/1/488206/100/0/threaded
Exploit
http://www.securityfocus.com/bid/27813
www.securitytracker.com
http://www.securitytracker.com/id?1019427
More from Es1000
–
CVE-2008-3177
Sophos virus detection engine 2.75 on Linux and Unix, as used in Sophos Email Appliance, Pure Message for Unix, and Sophos Anti-Virus Interface (SAVI), allows remote attackers to…