Vulnerability-Lookup

CVE-2008-0555 (GCVE-0-2008-0555)

Vulnerability from cvelistv5 – Published: 2008-04-04 00:00 – Updated: 2024-08-07 07:46

Summary

The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

10 references

URL	Tags
http://securityreason.com/securityalert/3797	third-party-advisoryx_refsource_SREASON
http://www.cynops.de/advisories/CVE-2008-0555.txt	x_refsource_MISC
http://www.vupen.com/english/advisories/2008/1079…	vdb-entryx_refsource_VUPEN
http://www.apache-ssl.org/advisory-cve-2008-0555.txt	x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www.securityfocus.com/bid/28576	vdb-entryx_refsource_BID
http://www.klink.name/security/aklink-sa-2008-005…	x_refsource_MISC
http://secunia.com/advisories/29644	third-party-advisoryx_refsource_SECUNIA
http://www.securitytracker.com/id?1019784	vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/archive/1/490386/100…	mailing-listx_refsource_BUGTRAQ

Date Public

2008-04-02 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T07:46:54.867Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "3797",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3797"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.cynops.de/advisories/CVE-2008-0555.txt"
          },
          {
            "name": "ADV-2008-1079",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1079/references"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt"
          },
          {
            "name": "apachessl-expandcert-information-disclosure(41618)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41618"
          },
          {
            "name": "28576",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/28576"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt"
          },
          {
            "name": "29644",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29644"
          },
          {
            "name": "1019784",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1019784"
          },
          {
            "name": "20080402 ANNOUNCE: Apache-SSL security release - apache_1.3.41+ssl_1.59",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/490386/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-04-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) \u0027/\u0027 and (2) \u0027=\u0027 characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-15T20:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "3797",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3797"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.cynops.de/advisories/CVE-2008-0555.txt"
        },
        {
          "name": "ADV-2008-1079",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1079/references"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt"
        },
        {
          "name": "apachessl-expandcert-information-disclosure(41618)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41618"
        },
        {
          "name": "28576",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/28576"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt"
        },
        {
          "name": "29644",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29644"
        },
        {
          "name": "1019784",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1019784"
        },
        {
          "name": "20080402 ANNOUNCE: Apache-SSL security release - apache_1.3.41+ssl_1.59",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/490386/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-0555",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) \u0027/\u0027 and (2) \u0027=\u0027 characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "3797",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3797"
            },
            {
              "name": "http://www.cynops.de/advisories/CVE-2008-0555.txt",
              "refsource": "MISC",
              "url": "http://www.cynops.de/advisories/CVE-2008-0555.txt"
            },
            {
              "name": "ADV-2008-1079",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1079/references"
            },
            {
              "name": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt",
              "refsource": "MISC",
              "url": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt"
            },
            {
              "name": "apachessl-expandcert-information-disclosure(41618)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41618"
            },
            {
              "name": "28576",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/28576"
            },
            {
              "name": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt",
              "refsource": "MISC",
              "url": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt"
            },
            {
              "name": "29644",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29644"
            },
            {
              "name": "1019784",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1019784"
            },
            {
              "name": "20080402 ANNOUNCE: Apache-SSL security release - apache_1.3.41+ssl_1.59",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/490386/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-0555",
    "datePublished": "2008-04-04T00:00:00.000Z",
    "dateReserved": "2008-02-01T00:00:00.000Z",
    "dateUpdated": "2024-08-07T07:46:54.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2008-0555",
      "date": "2026-09-29",
      "epss": "0.0187",
      "percentile": "0.78522"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:apache-ssl:apache-ssl:1.3.34_1.57:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F97198C6-EE6A-43C2-B69B-7026505F7DC0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) \u0027/\u0027 and (2) \u0027=\u0027 characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables."
        },
        {
          "lang": "es",
          "value": "La funci\u00f3n ExpandCert en Apache-SSL versiones anteriores apache_1.3.41+ssl_1.59 no gestiona correctamente los caracteres (1) \u0027/\u0027 y (2) \u0027=\u0027 en un Distinguished Name (DN) de un certificado de cliente, lo cual puede permitir a atacantes remotos evitar autenticarse a trav\u00e9s de un DN manipulado que dispara la sobreescritura de variables de entorno."
        }
      ],
      "id": "CVE-2008-0555",
      "lastModified": "2024-11-21T00:42:22.520",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "HIGH",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 7.5,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": true,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ]
      },
      "published": "2008-04-04T00:44:00.000",
      "references": [
        {
          "source": "cve@mitre.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://secunia.com/advisories/29644"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://securityreason.com/securityalert/3797"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Exploit"
          ],
          "url": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Exploit"
          ],
          "url": "http://www.cynops.de/advisories/CVE-2008-0555.txt"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Exploit"
          ],
          "url": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.securityfocus.com/archive/1/490386/100/0/threaded"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Patch"
          ],
          "url": "http://www.securityfocus.com/bid/28576"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.securitytracker.com/id?1019784"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.vupen.com/english/advisories/2008/1079/references"
        },
        {
          "source": "cve@mitre.org",
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41618"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://secunia.com/advisories/29644"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://securityreason.com/securityalert/3797"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Exploit"
          ],
          "url": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Exploit"
          ],
          "url": "http://www.cynops.de/advisories/CVE-2008-0555.txt"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Exploit"
          ],
          "url": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.securityfocus.com/archive/1/490386/100/0/threaded"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "http://www.securityfocus.com/bid/28576"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.securitytracker.com/id?1019784"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.vupen.com/english/advisories/2008/1079/references"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41618"
        }
      ],
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-20"
            },
            {
              "lang": "en",
              "value": "CWE-287"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apache-ssl:apache-ssl:1.3.34_1.57:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F97198C6-EE6A-43C2-B69B-7026505F7DC0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) \u0027/\u0027 and (2) \u0027=\u0027 characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables."
          },
          {
            "lang": "es",
            "value": "La funci\u00f3n ExpandCert en Apache-SSL versiones anteriores apache_1.3.41+ssl_1.59 no gestiona correctamente los caracteres (1) \u0027/\u0027 y (2) \u0027=\u0027 en un Distinguished Name (DN) de un certificado de cliente, lo cual puede permitir a atacantes remotos evitar autenticarse a trav\u00e9s de un DN manipulado que dispara la sobreescritura de variables de entorno."
          }
        ],
        "id": "CVE-2008-0555",
        "lastModified": "2026-04-23T00:35:47.467",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 7.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": true,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2008-04-04T00:44:00.000",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/29644"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://securityreason.com/securityalert/3797"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit"
            ],
            "url": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit"
            ],
            "url": "http://www.cynops.de/advisories/CVE-2008-0555.txt"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit"
            ],
            "url": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/490386/100/0/threaded"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch"
            ],
            "url": "http://www.securityfocus.com/bid/28576"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securitytracker.com/id?1019784"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2008/1079/references"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41618"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/29644"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://securityreason.com/securityalert/3797"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit"
            ],
            "url": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit"
            ],
            "url": "http://www.cynops.de/advisories/CVE-2008-0555.txt"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit"
            ],
            "url": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/490386/100/0/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "http://www.securityfocus.com/bid/28576"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securitytracker.com/id?1019784"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2008/1079/references"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41618"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              },
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

CERTA-2008-AVI-178

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Apache-SSL permettant d'interagir avec des données en mémoire.

Description

Apache-SSL est un serveur web construit à partir du serveur Apache, et d'OpenSSL.

Une vulnérabilité a été découverte dans ce serveur. Cette vulnérabilité est due à une mauvaise gestion de certaines données contenues dans les certificats clients. Elle peut être exploitée par un utilisateur malveillant afin de réécrire ou faire afficher des parties de la mémoire.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Apache-SSL versions antérieures à la version apache_1.3.41+ssl_1.59.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

CERTA-2008-AVI-178

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Apache-SSL permettant d'interagir avec des données en mémoire.

Description

Apache-SSL est un serveur web construit à partir du serveur Apache, et d'OpenSSL.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Apache-SSL versions antérieures à la version apache_1.3.41+ssl_1.59.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

FKIE_CVE-2008-0555

Vulnerability from fkie_nvd - Published: 2008-04-04 00:44 - Updated: 2026-06-16 22:49

Severity

Summary

References

URL	Tags
cve@mitre.org	http://secunia.com/advisories/29644	Vendor Advisory
cve@mitre.org	http://securityreason.com/securityalert/3797
cve@mitre.org	http://www.apache-ssl.org/advisory-cve-2008-0555.txt	Exploit
cve@mitre.org	http://www.cynops.de/advisories/CVE-2008-0555.txt	Exploit
cve@mitre.org	http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt	Exploit
cve@mitre.org	http://www.securityfocus.com/archive/1/490386/100/0/threaded
cve@mitre.org	http://www.securityfocus.com/bid/28576	Patch
cve@mitre.org	http://www.securitytracker.com/id?1019784
cve@mitre.org	http://www.vupen.com/english/advisories/2008/1079/references
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/41618
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/29644	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://securityreason.com/securityalert/3797
af854a3a-2127-422b-91ae-364da2661108	http://www.apache-ssl.org/advisory-cve-2008-0555.txt	Exploit
af854a3a-2127-422b-91ae-364da2661108	http://www.cynops.de/advisories/CVE-2008-0555.txt	Exploit
af854a3a-2127-422b-91ae-364da2661108	http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt	Exploit
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/490386/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/28576	Patch
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id?1019784
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2008/1079/references
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/41618

Impacted products

	Vendor	Product	Version
	apache-ssl	apache-ssl	1.3.34_1.57

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache-ssl:apache-ssl:1.3.34_1.57:*:*:*:*:*:*:*",
              "matchCriteriaId": "F97198C6-EE6A-43C2-B69B-7026505F7DC0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) \u0027/\u0027 and (2) \u0027=\u0027 characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n ExpandCert en Apache-SSL versiones anteriores apache_1.3.41+ssl_1.59 no gestiona correctamente los caracteres (1) \u0027/\u0027 y (2) \u0027=\u0027 en un Distinguished Name (DN) de un certificado de cliente, lo cual puede permitir a atacantes remotos evitar autenticarse a trav\u00e9s de un DN manipulado que dispara la sobreescritura de variables de entorno."
    }
  ],
  "id": "CVE-2008-0555",
  "lastModified": "2026-06-16T22:49:52.087",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-04-04T00:44:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/29644"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/3797"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.cynops.de/advisories/CVE-2008-0555.txt"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/490386/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/28576"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1019784"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/1079/references"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41618"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/29644"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/3797"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.cynops.de/advisories/CVE-2008-0555.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/490386/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/28576"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1019784"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/1079/references"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41618"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-7843-HCHM-WF25

Vulnerability from github – Published: 2022-05-01 23:31 – Updated: 2022-05-01 23:31

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2008-0555"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-04-04T00:44:00Z",
    "severity": "HIGH"
  },
  "details": "The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) \u0027/\u0027 and (2) \u0027=\u0027 characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables.",
  "id": "GHSA-7843-hchm-wf25",
  "modified": "2022-05-01T23:31:26Z",
  "published": "2022-05-01T23:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-0555"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41618"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/29644"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/3797"
    },
    {
      "type": "WEB",
      "url": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.cynops.de/advisories/CVE-2008-0555.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/490386/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/28576"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1019784"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/1079/references"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2008-0555

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2008-0555

Aliases

CVE-2008-0555

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2008-0555",
    "description": "The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) \u0027/\u0027 and (2) \u0027=\u0027 characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables.",
    "id": "GSD-2008-0555"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2008-0555"
      ],
      "details": "The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) \u0027/\u0027 and (2) \u0027=\u0027 characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables.",
      "id": "GSD-2008-0555",
      "modified": "2023-12-13T01:22:59.192143Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2008-0555",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) \u0027/\u0027 and (2) \u0027=\u0027 characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "3797",
            "refsource": "SREASON",
            "url": "http://securityreason.com/securityalert/3797"
          },
          {
            "name": "http://www.cynops.de/advisories/CVE-2008-0555.txt",
            "refsource": "MISC",
            "url": "http://www.cynops.de/advisories/CVE-2008-0555.txt"
          },
          {
            "name": "ADV-2008-1079",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2008/1079/references"
          },
          {
            "name": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt",
            "refsource": "MISC",
            "url": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt"
          },
          {
            "name": "apachessl-expandcert-information-disclosure(41618)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41618"
          },
          {
            "name": "28576",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/28576"
          },
          {
            "name": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt",
            "refsource": "MISC",
            "url": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt"
          },
          {
            "name": "29644",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/29644"
          },
          {
            "name": "1019784",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id?1019784"
          },
          {
            "name": "20080402 ANNOUNCE: Apache-SSL security release - apache_1.3.41+ssl_1.59",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/490386/100/0/threaded"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache-ssl:apache-ssl:1.3.34_1.57:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-0555"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) \u0027/\u0027 and (2) \u0027=\u0027 characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-287"
                },
                {
                  "lang": "en",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.cynops.de/advisories/CVE-2008-0555.txt",
              "refsource": "MISC",
              "tags": [
                "Exploit"
              ],
              "url": "http://www.cynops.de/advisories/CVE-2008-0555.txt"
            },
            {
              "name": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt",
              "refsource": "MISC",
              "tags": [
                "Exploit"
              ],
              "url": "http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt"
            },
            {
              "name": "28576",
              "refsource": "BID",
              "tags": [
                "Patch"
              ],
              "url": "http://www.securityfocus.com/bid/28576"
            },
            {
              "name": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt",
              "refsource": "MISC",
              "tags": [
                "Exploit"
              ],
              "url": "http://www.apache-ssl.org/advisory-cve-2008-0555.txt"
            },
            {
              "name": "1019784",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id?1019784"
            },
            {
              "name": "29644",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/29644"
            },
            {
              "name": "3797",
              "refsource": "SREASON",
              "tags": [],
              "url": "http://securityreason.com/securityalert/3797"
            },
            {
              "name": "ADV-2008-1079",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2008/1079/references"
            },
            {
              "name": "apachessl-expandcert-information-disclosure(41618)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41618"
            },
            {
              "name": "20080402 ANNOUNCE: Apache-SSL security release - apache_1.3.41+ssl_1.59",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/490386/100/0/threaded"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": true,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2018-10-15T22:01Z",
      "publishedDate": "2008-04-04T00:44Z"
    }
  }
}

JVNDB-2009-001741

Vulnerability from jvndb - Published: 2009-07-14 01:17 - Updated:2014-05-21 09:16

Severity

N/A (UNKNOWN) - -

Summary

Hitachi Web Server Vulnerability in SSL Client Authentication

Details

Hitachi Web Server contains a vulnerability in handling SSL client certificates, which could allow an attacker to manipulate environment variables and/or spoof the client to access Web servers.

References

Type

URL

	CVE	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0555
	NVD	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-0555
	No Mapping(CWE-noinfo)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	Hitachi, Ltd	Cosminexus Application Server Enterprise
	Hitachi, Ltd	Cosminexus Application Server Standard
	Hitachi, Ltd	Cosminexus Application Server Version 5
	Hitachi, Ltd	Cosminexus Developer Light Version 6
	Hitachi, Ltd	Cosminexus Developer Professional Version 6
	Hitachi, Ltd	Cosminexus Developer Standard Version 6
	Hitachi, Ltd	Cosminexus Developer Version 5
	Hitachi, Ltd	Cosminexus Server - Standard Edition Version 4
	Hitachi, Ltd	Cosminexus Server - Web Edition Version 4
	Hitachi, Ltd	Hitachi Web Server
	Hitachi, Ltd	uCosminexus Application Server Enterprise
	Hitachi, Ltd	uCosminexus Application Server Standard
	Hitachi, Ltd	uCosminexus Developer
	Hitachi, Ltd	uCosminexus Developer Light
	Hitachi, Ltd	uCosminexus Developer Standard
	Hitachi, Ltd	uCosminexus Service Architect
	Hitachi, Ltd	uCosminexus Service Platform

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-001741.html",
  "dc:date": "2014-05-21T18:16+09:00",
  "dcterms:issued": "2009-07-14T10:17+09:00",
  "dcterms:modified": "2014-05-21T18:16+09:00",
  "description": "Hitachi Web Server contains a vulnerability in handling SSL client\r\ncertificates, which could allow an attacker to manipulate environment\r\nvariables and/or spoof the client to access Web servers.",
  "link": "https://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-001741.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:hitachi:cosminexus_application_server_enterprise",
      "@product": "Cosminexus Application Server Enterprise",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:cosminexus_application_server_standard",
      "@product": "Cosminexus Application Server Standard",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:cosminexus_application_server_version_5",
      "@product": "Cosminexus Application Server Version 5",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:cosminexus_developer_light_version_6",
      "@product": "Cosminexus Developer Light Version 6",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:cosminexus_developer_professional_version_6",
      "@product": "Cosminexus Developer Professional Version 6",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:cosminexus_developer_standard_version_6",
      "@product": "Cosminexus Developer Standard Version 6",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:cosminexus_developer_version_5",
      "@product": "Cosminexus Developer Version 5",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:cosminexus_server_-_standard_edition_version_4",
      "@product": "Cosminexus Server - Standard Edition Version 4",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:cosminexus_server_-_web_edition_version_4",
      "@product": "Cosminexus Server - Web Edition Version 4",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:hitachi_web_server",
      "@product": "Hitachi Web Server",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:ucosminexus_application_server_enterprise",
      "@product": "uCosminexus Application Server Enterprise",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:ucosminexus_application_server_standard",
      "@product": "uCosminexus Application Server Standard",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:ucosminexus_developer",
      "@product": "uCosminexus Developer",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:ucosminexus_developer_light",
      "@product": "uCosminexus Developer Light",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:ucosminexus_developer_standard",
      "@product": "uCosminexus Developer Standard",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:ucosminexus_service_architect",
      "@product": "uCosminexus Service Architect",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:ucosminexus_service_platform",
      "@product": "uCosminexus Service Platform",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "4.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2009-001741",
  "sec:references": [
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0555",
      "@id": "CVE-2008-0555",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-0555",
      "@id": "CVE-2008-0555",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-noinfo",
      "@title": "No Mapping(CWE-noinfo)"
    }
  ],
  "title": "Hitachi Web Server Vulnerability in SSL Client Authentication"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2008-0555 (GCVE-0-2008-0555)

CERTA-2008-AVI-178

Description

Solution

CERTA-2008-AVI-178

Description

Solution

FKIE_CVE-2008-0555

GHSA-7843-HCHM-WF25

GSD-2008-0555

JVNDB-2009-001741

Tags

Sightings

Nomenclature

Related by attack behaviour