CVE-2008-3700

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-08-15 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite 3.20.02 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the sessionid parameter in a livesupport startclientchat action to visitor/index.php; (2) the filter parameter in a news view action to index.php; or the Full Name field in a (3) account creation, (4) ticket opening, or (5) chat request operation.

Affected products

Kayako Supportsuite: through 3.20.02; 3.10.00, 3.10.02, 3.11.00, 3.11.01

References

http://forums.kayako.com/f3/3-30-00-stable-released-18304/
http://osvdb.org/47613
http://osvdb.org/47614
http://osvdb.org/47615
http://secunia.com/advisories/31431
http://www.gulftech.org/?node=research&article_id=00123-08092008
http://www.securityfocus.com/bid/30642
https://exchange.xforce.ibmcloud.com/vulnerabilities/44382
https://exchange.xforce.ibmcloud.com/vulnerabilities/44383
http://forums.kayako.com/f3/3-30-00-stable-released-18304/
http://osvdb.org/47613
http://osvdb.org/47614

Get alerted when CVE-2008-3700 or the next vulnerability affects your stack