{"id":"CVE-2008-3821","aliases":["EUVD-2008-3807","GHSA-xrr6-c8rc-c2wp"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 11.0 through...","description":"Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 11.0 through 12.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the ping program or (2) unspecified other aspects of the URI.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05449,"percentile":0.9279,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2009-01-16T21:00:00Z","modified":"2026-06-16T22:56:36Z","exploits":[{"source":"exploitdb","id":"EDB-32723","title":"Cisco IOS 12.x - HTTP Server Multiple Cross-Site Scripting Vulnerabilities","type":"remote","platform":"hardware","date":"2009-01-14","verified":true,"url":"https://www.exploit-db.com/exploits/32723"}],"products":[{"vendor":"cisco","product":"ios"}],"references":[{"url":"http://jvn.jp/en/jp/JVN28344798/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://osvdb.org/51393","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link"]},{"url":"http://securitytracker.com/id?1021598","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://securityreason.com/securityalert/4916","tags":["third-party-advisory","x_refsource_SREASON","x_transferred","Third Party Advisory"]},{"url":"http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-19","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://www.securityfocus.com/bid/33260","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/47947","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.vupen.com/english/advisories/2009/0138","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Not Applicable"]},{"url":"http://www.cisco.com/en/US/products/products_security_response09186a0080a5c501.html","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/33461","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://osvdb.org/51394","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link"]},{"url":"http://www.securityfocus.com/archive/1/500063/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-3821"},{"url":"https://github.com/advisories/GHSA-xrr6-c8rc-c2wp"}],"sources":{"cve":[{"id":"CVE-2008-3821","description":"Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 11.0 through 12.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the ping program or (2) unspecified other aspects of the URI.","status":"published","published":"2009-01-16T21:00:00Z","modified":"2024-08-07T09:53:00.318Z","updated_at":"2026-11-02T14:34:45.504702Z"}],"euvd":[{"id":"EUVD-2008-3807","description":"Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 11.0 through 12.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the ping program or (2) unspecified other aspects of the URI.","status":"published","published":"2009-01-16T21:00:00Z","modified":"2024-08-07T09:53:00Z","updated_at":"2026-11-03T01:38:50.380359Z"}],"ghsa":[{"id":"GHSA-xrr6-c8rc-c2wp","title":"Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 11.0 through...","description":"Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 11.0 through 12.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the ping program or (2) unspecified other aspects of the URI.","status":"published","published":"2022-05-02T00:03:53Z","modified":"2023-01-31T05:06:21Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:49:01.018652Z"}],"nvd":[{"id":"CVE-2008-3821","description":"Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 11.0 through 12.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the ping program or (2) unspecified other aspects of the URI.","status":"published","published":"2009-01-16T21:30:03.28Z","modified":"2026-06-16T22:56:36.317Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:01:31.111729Z"}]}}