CVE-2008-2637
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and...
CVE-2008-2637 is a medium vulnerability (CVSS 4.3) in F5 Firepass Ssl Vpn, published June 10, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 79th percentile. No source names a fixed version.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 1.82%EPSS, 79th percentile
- Exploitation
- None known2 public exploits
- Fixed in
- No fix listedNo source names one
Description
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in (1) the css_exceptions parameter in vdesk/admincon/webyfiers.php and (2) the sql_matchscope parameter in vdesk/admincon/index.php.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | F5 FirePass 6.0.2.3 - '/vdesk/admincon/webyfiers.php?css_exceptions' Cross-Site Scripting | 2008-06-05 |
| Exploit-DB | F5 FirePass 6.0.2.3 - '/vdesk/admincon/index.php?sql_matchscope' Cross-Site Scripting | 2008-06-05 |
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in (1) the css_exceptions parameter in vdesk/admincon/webyfiers.php and (2) the sql_matchscope parameter in vdesk/admincon/index.php.
- Record
CVE-2008-2637- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in (1) the css_exceptions parameter in vdesk/admincon/webyfiers.php and (2) the sql_matchscope parameter in vdesk/admincon/index.php.
- Record
CVE-2008-2637- Updated
- 2026-11-02
EUVDEUVD-2008-2632No score
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in (1) the css_exceptions parameter in vdesk/admincon/webyfiers.php and (2) the sql_matchscope parameter in vdesk/admincon/index.php.
- Record
EUVD-2008-2632- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fc3v-jjjq-68v3No score
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and...
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in (1) the css_exceptions parameter in vdesk/admincon/webyfiers.php and (2) the sql_matchscope parameter in vdesk/admincon/index.php.
- Record
GHSA-fc3v-jjjq-68v3- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securitytracker.com/id?1020205
vupen.com/english/advisories/2008/1765/references
securityfocus.com/archive/1/493149/100/0/threaded
secunia.com/advisories/30550
securityreason.com/securityalert/3931
exchange.xforce.ibmcloud.com/vulnerabilities/42884
nvd.nist.gov/vuln/detail/CVE-2008-2637
github.com/advisories/GHSA-fc3v-jjjq-68v3