NVD

Id
50119  
Name
CVE-2009-2897  
Description
Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from (1) the typeId parameter to mastheadAttach.do, (2) the eid parameter to Resource.do, and (3) the u parameter in a view action to admin/user/UserAdmin.do. NOTE: some of these details are obtained from third party information.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2009-10-13  
Modified Date
2009-10-14  
Seq
2009-2897  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
253626 50119 CVE-2009-2897 http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=advisory&name=Hyperic_HQ_Multiple_XSS  View
253627 50119 CVE-2009-2897 http://forums.hyperic.com/jiveforums/thread.jspa?messageID=22156&#22156  View
253628 50119 CVE-2009-2897 http://jira.hyperic.com/browse/HHQ-2655  View
253629 50119 CVE-2009-2897 http://www.coresecurity.com/content/hyperic-hq-vulnerabilities  View
253630 50119 CVE-2009-2897 20091003 CORE-2009-0812-Hyperic HQ Multiple XSS  View
253631 50119 CVE-2009-2897 20091002 CVE-2009-2897: Hyperic HQ - Reflected XSS in stack trace  View
253632 50119 CVE-2009-2897 http://www.springsource.com/security/hyperic-hq  View
253633 50119 CVE-2009-2897 hyperichq-mastheadattach-xss(53658)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
45233 JVNDB-2009-006240 SpringSource Hyperic HQ などの製品の hq/web/common/GenericError.jsp におけるクロスサイトスクリプティングの脆弱性 SpringSource Hyperic HQ、Application Management Suite (AMS)、および tc Server の Web インターフェースのジェネリック例外ハンドラの hq/web/common/GenericError.jsp には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2009-2897 40328 CVE-2009-2897 50119 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-006240.html 2009-10-13 2012-12-20 View