CVE-2008-4918

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-11-04 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering, which is not properly handled in the CFS block page, aka "universal website hijacking."

Affected products

SonicWall Sonicos Enhanced: before 4.0.1.1 — fixed in 4.0.1.1

How to fix

Upgrade to a fixed version: SonicWall Sonicos Enhanced 4.0.1.1. Check the vendor advisory for mitigations.

References

http://secunia.com/advisories/32498
http://securityreason.com/securityalert/4556
http://www.gnucitizen.org/blog/new-technique-to-perform-universal-website-hijacking/
http://www.securityfocus.com/archive/1/497948/100/0/threaded
http://www.securityfocus.com/archive/1/497958/100/0/threaded
http://www.securityfocus.com/archive/1/497968/100/0/threaded
http://www.securityfocus.com/archive/1/497989/100/0/threaded
http://www.securityfocus.com/archive/1/498043/100/0/threaded
http://www.securityfocus.com/archive/1/498073/100/0/threaded
http://www.securityfocus.com/bid/31998
http://www.sonicwall.com/downloads/SonicOS_Enhanced_4.0.1.1_Release_Notes.pdf
http://www.vupen.com/english/advisories/2008/2970

Get alerted when CVE-2008-4918 or the next vulnerability affects your stack