CVE-2008-2637

Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and...

4.3 MediumPublic exploit

Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in (1) the css_exceptions parameter in vdesk/admincon/webyfiers.php and (2) the sql_matchscope parameter in vdesk/admincon/index.php.

Exploit likelihood

1.82%Down 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2008-2637
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-2637
Updated: 2026-11-02

EUVDEUVD-2008-2632 No score

Record: EUVD-2008-2632
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fc3v-jjjq-68v3 No score

Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and...

Record: GHSA-fc3v-jjjq-68v3
Weakness: CWE-79
Updated: 2026-11-02

Affected products

f5 firepass ssl vpn

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	F5 FirePass 6.0.2.3 - '/vdesk/admincon/webyfiers.php?css_exceptions' Cross-Site Scripting	2008-06-05
Exploit-DB	F5 FirePass 6.0.2.3 - '/vdesk/admincon/index.php?sql_matchscope' Cross-Site Scripting	2008-06-05

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-2637 is a medium vulnerability (CVSS 4.3) in F5 Firepass Ssl Vpn, published June 10, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 78th percentile. No source names a fixed version.