CVE-2008-5266: Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 w...

Security readout for executives and security teams

This is an old cross-site scripting issue in the GlassFish web administration interface. If an administrator opens a crafted interaction involving the affected page, attacker-controlled script or HTML could run in that admin context. The source bundle does not provide CVSS, patch details, or evidence of active exploitation. Exposure is most likely where legacy GlassFish or Sun Java System Application Server administrative interfaces remain deployed and reachable. Internet-exposed admin consoles or consoles accessible by many internal users raise risk. The bundle does not establish exposure beyond the versions named in the CVE description. Treat this as a targeted legacy-system risk. It is not supported by the bundle as actively exploited, but administrative-console XSS can matter because it may affect privileged users. Prioritize finding exposed legacy admin consoles and reducing access quickly. Mitigation focus: Check vendor guidance or release notes for fixed GlassFish or Sun Application Server builds.; Restrict webadmin access to trusted management networks and authenticated administrators.; Remove public exposure of administrative interfaces wherever possible..

Prepared

Jun 28, 2026, 11:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.