How severe is CVE-2008-5423?

CVE-2008-5423 has a CVSS 2.0 base score of 4.3, rated medium severity.

Is CVE-2008-5423 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2008-5423?

CVE-2008-5423 primarily affects Sun Ray Server Software. In total, 15 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2008-5423?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2008-5423 published?

CVE-2008-5423 was published on 2008-12-11 and last updated on 2026-06-16.

CVE-2008-5423

CVE-2008-5423 is a medium-severity vulnerability in Sun Ray Server Software with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-200.

Key facts

Severity: Medium (CVSS 2.0 base score 4.3)
EPSS exploit prediction: 0% (23rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-200
Affected product: Sun Ray Server Software
Published: 2008-12-11
Last modified: 2026-06-16

Description

Sun Sun Ray Server Software 3.x and 4.0 and Sun Ray Windows Connector 1.1 and 2.0 expose the LDAP password during a configuration step, which allows local users to discover the Sun Ray administration password, and obtain admin access to the Data Store and Administration GUI, via unspecified vectors related to the utconfig component of the Server Software and the uttscadm component of the Windows Connector.

Frequently asked questions

What is CVE-2008-5423?: Sun Sun Ray Server Software 3.x and 4.0 and Sun Ray Windows Connector 1.1 and 2.0 expose the LDAP password during a configuration step, which allows local users to discover the Sun Ray administration password, and obtain admin access to the Data Store and Administration GUI, via unspecified vectors related to the utconfig component of the Server Software and the uttscadm component of the Windows Connector.
How severe is CVE-2008-5423?: CVE-2008-5423 has a CVSS 2.0 base score of 4.3, rated medium severity.
Is CVE-2008-5423 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2008-5423?: CVE-2008-5423 primarily affects Sun Ray Server Software. In total, 15 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2008-5423?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2008-5423 published?: CVE-2008-5423 was published on 2008-12-11 and last updated on 2026-06-16.

References

Affected products (15)

cpe:2.3:a:sun:ray_server_software:3.0:*:sparc:*:*:*:*:*
cpe:2.3:a:sun:ray_server_software:3.1:*:sparc:*:*:*:*:*
cpe:2.3:a:sun:ray_server_software:4.0:*:sparc:*:*:*:*:*
cpe:2.3:a:sun:ray_server_software:3.1:*:x86:*:*:*:*:*
cpe:2.3:a:sun:ray_server_software:4.0:*:x86:*:*:*:*:*
cpe:2.3:a:sun:ray_windows_connector:1.1:*:sparc:*:*:*:*:*
cpe:2.3:a:sun:ray_windows_connector:2.0:*:sparc:*:*:*:*:*
cpe:2.3:a:sun:ray_windows_connector:1.1:*:x86:*:*:*:*:*
cpe:2.3:a:sun:ray_windows_connector:2.0:*:x86:*:*:*:*:*
cpe:2.3:a:sun:ray_windows_connector:1.1:*:linux:*:*:*:*:*
cpe:2.3:a:sun:ray_windows_connector:2.0:*:linux:*:*:*:*:*
cpe:2.3:a:sun:ray_server_software:3.1.1:*:linux:*:*:*:*:*
cpe:2.3:a:sun:ray_server_software:4.0:*:linux:*:*:*:*:*
cpe:2.3:a:sun:ray_server_software:3.0:*:linux:*:*:*:*:*
cpe:2.3:a:sun:ray_server_software:3.1:*:linux:*:*:*:*:*

More vulnerabilities in Sun Ray Server Software

CVE-2009-4294 — Critical (CVSS 10.0): Unspecified vulnerability in the Authentication Manager (aka utauthd) in Sun Ray Server Software 4.0 and 4.1 allows…
CVE-2008-2112 — High (CVSS 8.5): Unspecified vulnerability in Sun Ray Kiosk Mode 4.0 allows local and remote authenticated Sun Ray administrators to…
CVE-2009-4295 — High (CVSS 7.8): Sun Ray Server Software 4.0 and 4.1 does not generate a unique DSA private key for the firmware on each Sun Ray 1, 1g,…
CVE-2007-6482 — High (CVSS 7.8): Unspecified vulnerability in the Device Manager daemon (utdevmgrd) in Sun Ray Server Software 2.0, 3.0, 3.1, and 3.1.1…
CVE-2008-5422 — High (CVSS 7.5): Sun Sun Ray Server Software 3.1 through 4.0 does not properly restrict access, which allows remote attackers to…
CVE-2002-2036 — High (CVSS 7.5): Sun Ray Server Software (SRSS) 1.3, when Non-Smartcard Mobility (NSCM) is enabled, allows remote attackers to login as…

All CVEs affecting Sun Ray Server Software →

Other CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerabilities

CVE-2026-27604 — Critical (CVSS 10.0): FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version…
CVE-2026-40965 — Critical (CVSS 10.0): Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a…
CVE-2026-42826 — Critical (CVSS 10.0): Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose…
CVE-2025-29270 — Critical (CVSS 10.0): Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows…
CVE-2025-61481 — Critical (CVSS 10.0): An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by…
CVE-2025-53624 — Critical (CVSS 10.0): The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user.…

Browse all CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerabilities →