CVE-2008-7017 json
Cross-site scripting (XSS) vulnerability in analyse.php in CAcert 20080921, and possibly other versions before 20080928, allows remote atta…
published 2009-08-21 17 y ago modified 2026-06-16 4 mo ago also EUVD-2008-6976
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 1
- Exploit-DB
Summary
Cross-site scripting (XSS) vulnerability in analyse.php in CAcert 20080921, and possibly other versions before 20080928, allows remote attackers to inject arbitrary web script or HTML via the CN (CommonName) field in the subject of an X.509 certificate.
Timeline
- First public exploit (EDB-32443)
- Published
Exploit prediction
0.90% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-32443 CAcert - 'analyse.php' Cross-Site Scripting webapps, 2008-09-29
- cynops.de http://www.cynops.de/advisories/AKLINK-SA-2008-007.txt referenced PoC, tagged "exploit" by a source, unverified
- securityfocus.com http://www.securityfocus.com/bid/31481 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
cynops.de
/advisories/AKLINK-SA-2008-007.txt
exploit
-
securityfocus.com
/bid/31481
vdb-entry, exploit
-
exchange.xforce.ibmcloud.com
/vulnerabilities/45515
vdb-entry
Sources
- CVE List CVE-2008-7017
- NVD CVE-2008-7017
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.