CVE-2008-2402
First published: Wed Jun 04 2008(Updated: )
The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read password hashes and configuration data via direct requests for unspecified documents.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sun Java Asp Server | <=4.0.2 | |
| Sun Java Asp Server | =4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=706
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-238184-1
- http://www.securitytracker.com/id?1020187
- http://secunia.com/advisories/30523
- http://www.securityfocus.com/bid/29540
- http://www.vupen.com/english/advisories/2008/1742/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42828
Frequently Asked Questions
What is the severity of CVE-2008-2402?
CVE-2008-2402 is considered to be a medium severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2008-2402?
To fix CVE-2008-2402, update Sun Java Active Server Pages to version 4.0.3 or later to ensure proper access controls.
What information is exposed by CVE-2008-2402?
CVE-2008-2402 exposes sensitive information such as password hashes and configuration data due to insufficient access control.
Which versions of Sun Java Active Server Pages are affected by CVE-2008-2402?
CVE-2008-2402 affects Sun Java Active Server Pages versions before 4.0.3, including 4.0 and earlier.
Can CVE-2008-2402 be exploited remotely?
Yes, CVE-2008-2402 can be exploited remotely by attackers to read sensitive documents through direct requests.
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/sun
- canonical/sun java asp server
- version/sun java asp server/4.0.2
- version/sun java asp server/4.0