CVE-2008-2402
The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive...
The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read password hashes and configuration data via direct requests for unspecified documents.
Exploit likelihood
What each source reports
NVD Score used
The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read password hashes and configuration data via direct requests for unspecified documents.
- Record
CVE-2008-2402- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read password hashes and configuration data via direct requests for unspecified documents.
- Record
CVE-2008-2402- Updated
- 2026-11-02
EUVDEUVD-2008-2397 No score
The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read password hashes and configuration data via direct requests for unspecified documents.
- Record
EUVD-2008-2397- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9wrf-3x99-v8v2 No score
The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive...
The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read password hashes and configuration data via direct requests for unspecified documents.
- Record
GHSA-9wrf-3x99-v8v2- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2402 is a medium vulnerability (CVSS 5.0) in Sun Java Asp Server, published June 4, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.4%, the 96th percentile. No source names a fixed version.
References
labs.idefense.com/intelligence/vulnerabilities/display.php?id=706
securitytracker.com/id?1020187
exchange.xforce.ibmcloud.com/vulnerabilities/42828
sunsolve.sun.com/search/document.do?assetkey=1-66-238184-1
vupen.com/english/advisories/2008/1742/references
secunia.com/advisories/30523
securityfocus.com/bid/29540
nvd.nist.gov/vuln/detail/CVE-2008-2402
github.com/advisories/GHSA-9wrf-3x99-v8v2