CVE-2008-2929: XSS
It was discovered that multiple CGI scripts used by Red Hat / Fedora Directory Server did not properly sanitize %-escaped inputs, resulting in a possibility to conduct cross-site scripting (XSS) attacks.
Issue was caused by a flow in an adminutil library that contain common functionality used by multiple CGI scripts, such as affected GET / POST argument parsing.
Issue is know to affect some Administration Express scripts and Directory Server Gateway (DSGW) scripts.
Affected version: Red Hat Directory Server 7.1 Red Hat Directory Server 8 (flaw limited to Administration Express issues, as DSGW component is not shipped) Fedora Directory Server
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject arbitrary web script or HTML via input values that use % (percent) escaping.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2929?
CVE-2008-2929 is classified as a moderate severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2008-2929?
To fix CVE-2008-2929, you should apply the latest security patches available for the affected versions of Red Hat Directory Server.
Which versions of Red Hat Directory Server are affected by CVE-2008-2929?
CVE-2008-2929 affects Red Hat Directory Server versions 7.1 and 8.0, specifically patches such as SP1 to SP6 for 7.1 and both el4 and el5 for 8.0.
What type of attacks can CVE-2008-2929 facilitate?
CVE-2008-2929 can facilitate cross-site scripting (XSS) attacks due to improper input sanitization in CGI scripts.
Is CVE-2008-2929 specific to Red Hat only?
While primarily associated with Red Hat Directory Server, CVE-2008-2929 may also affect similar implementations or versions of the Fedora Directory Server.