Unscored severity · published Jun 4, 2008
CVE-2008-2402
The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive information under the web root with insufficient access control, which allows remote…
–
CVSS
11.4%
EPSS
No
On KEV
Description
The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read password hashes and configuration data via direct requests for unspecified documents.
Exploitation
Is it being used?
Exploit prediction (EPSS)11.4% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
Java Asp Server · Sun
through 4.0.2; 4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-2402
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-2402
labs.idefense.com
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=706
secunia.com
http://secunia.com/advisories/30523
Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-238184-1
www.securityfocus.com
http://www.securityfocus.com/bid/29540
www.securitytracker.com
http://www.securitytracker.com/id?1020187
www.vupen.com
http://www.vupen.com/english/advisories/2008/1742/references
More from Java Asp Server
–
CVE-2008-2403
Multiple directory traversal vulnerabilities in unspecified ASP applications in Sun Java Active Server Pages (ASP) Server before 4.0.3 allow remote attackers to read or delete…
–
CVE-2008-2404
Stack-based buffer overflow in the request handling implementation in Sun Java Active Server Pages (ASP) Server before 4.0.3 allows remote attackers to execute arbitrary code via…
–
CVE-2008-2406
The administration application server in Sun Java Active Server Pages (ASP) Server before 4.0.3 allows remote attackers to bypass authentication via direct requests on TCP port…