CVE-2008-7250

2022-10-0316:13:53

Debian Security Bug Tracker

security-tracker.debian.org

cross-site scripting

sarg 2.2.4

remote attackers

javascript onload event

squid proxy log

incomplete fix

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

70.9%

JSON

Cross-site scripting (XSS) vulnerability in Squid Analysis Report Generator (Sarg) 2.2.4 allows remote attackers to inject arbitrary web script or HTML via a JavaScript onload event in the User-Agent header, which is not properly handled when displaying the Squid proxy log. NOTE: this issue exists because of an incomplete fix for CVE-2008-1168.

OSVersionArchitecturePackageVersionFilename
Debian12allsarg< 2.2.5-1sarg_2.2.5-1_all.deb
Debian999allsarg< 2.2.5-1sarg_2.2.5-1_all.deb
Debian13allsarg< 2.2.5-1sarg_2.2.5-1_all.deb