Vulnerability Description
Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering, which is not properly handled in the CFS block page, aka "universal website hijacking."
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sonicwall | Sonicos Enhanced | < 4.0.1.1 |
| Sonicwall | Pro 2040 | - |
| Sonicwall | Tz 180 | - |
| Sonicwall | Tz 190 | - |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/32498Not Applicable
- http://securityreason.com/securityalert/4556Third Party Advisory
- http://www.gnucitizen.org/blog/new-technique-to-perform-universal-website-hijackThird Party Advisory
- http://www.securityfocus.com/archive/1/497948/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/497958/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/497968/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/497989/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/498043/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/498073/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/31998Third Party AdvisoryVDB Entry
- http://www.sonicwall.com/downloads/SonicOS_Enhanced_4.0.1.1_Release_Notes.pdfBroken Link
- http://www.vupen.com/english/advisories/2008/2970Permissions Required
- http://www.zerodayinitiative.com/advisories/ZDI-08-070Third Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-08-070/Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46232Third Party AdvisoryVDB Entry
FAQ
What is CVE-2008-4918?
CVE-2008-4918 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML ...
How severe is CVE-2008-4918?
CVE-2008-4918 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-4918?
Check the references section above for vendor advisories and patch information. Affected products include: Sonicwall Sonicos Enhanced, Sonicwall Pro 2040, Sonicwall Tz 180, Sonicwall Tz 190.