CVEvulnerability
CVE-2008-2402
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-06-04
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read password hashes and configuration data via direct requests for unspecified documents.
Affected configurations
• sun java asp server (<= 4.0.2)
• sun java asp server 4.0
Related
Weakness · not in database (1)
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=706 labs.idefense.com
- http://secunia.com/advisories/30523 secunia.com
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-238184-1 Patch
- http://www.securityfocus.com/bid/29540 www.securityfocus.com
- http://www.securitytracker.com/id?1020187 www.securitytracker.com
- http://www.vupen.com/english/advisories/2008/1742/references www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42828 exchange.xforce.ibmcloud.com
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=706 labs.idefense.com
- http://secunia.com/advisories/30523 secunia.com
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-238184-1 Patch
- http://www.securityfocus.com/bid/29540 www.securityfocus.com
- http://www.securitytracker.com/id?1020187 www.securitytracker.com
- http://www.vupen.com/english/advisories/2008/1742/references www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42828 exchange.xforce.ibmcloud.com