Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-5115

CWE-352 — Cross-Site Request Forgery (CSRF)4 documents4 sources
Severity
6.8MEDIUM
EPSS
0.8%
top 25.88%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
SUN Java System Identity Manager
Timeline
PublishedNov 18
Latest updateMay 14

Description

Cross-site request forgery (CSRF) vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to hijack the authentication of administrators for requests that update the password via idm/admin/changeself.jsp.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages1 packages

Patches

Patch: sunsolve.sun.com ↗Patch: sunsolve.sun.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-6h23-ph84-8fvv: Cross-site request forgery (CSRF) vulnerability in Sun Java System Identity Manager 6↗2022-05-14
▶
CVEList
CVE-2008-5115: Cross-site request forgery (CSRF) vulnerability in Sun Java System Identity Manager 6↗2008-11-18
▶

💥Exploits & PoCs

1
Exploit-DB
Sun Java System Identity Manager 6.0/7.x - Multiple Vulnerabilities↗2008-11-11
▶