CVE-2009-1380

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2009-1380
Cross-site scripting (XSS) vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key property and the position of quote and colon characters.

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://secunia.com/advisories/37671 Vendor Advisory
http://securitytracker.com/id?1023315
http://www.securityfocus.com/bid/37276
https://bugzilla.redhat.com/show_bug.cgi?id=511224 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/54698
https://jira.jboss.org/jira/browse/JBPAPP-1983
https://rhn.redhat.com/errata/RHSA-2009-1636.html Vendor Advisory
https://rhn.redhat.com/errata/RHSA-2009-1637.html
https://rhn.redhat.com/errata/RHSA-2009-1649.html Vendor Advisory
https://rhn.redhat.com/errata/RHSA-2009-1650.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:cp01:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:cp02:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:cp03:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp01:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp02:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp03:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp04:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp05:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp06:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp07:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3:cp01:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp01:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp02:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp03:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp04:*:*:*:*:*:*
History

13 Feb 2023, 02:20

Type Values Removed Values Added
Summary CVE-2009-1380 jbossas JMX-Console cross-site-scripting in filter parameter Cross-site scripting (XSS) vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key property and the position of quote and colon characters.
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2009:1636', 'name': 'https://access.redhat.com/errata/RHSA-2009:1636', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2009:1637', 'name': 'https://access.redhat.com/errata/RHSA-2009:1637', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2009-1380', 'name': 'https://access.redhat.com/security/cve/CVE-2009-1380', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2009:1650', 'name': 'https://access.redhat.com/errata/RHSA-2009:1650', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2009:1649', 'name': 'https://access.redhat.com/errata/RHSA-2009:1649', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 15:15

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/errata/RHSA-2009:1636 -
  • (MISC) https://access.redhat.com/errata/RHSA-2009:1637 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2009-1380 -
  • (MISC) https://access.redhat.com/errata/RHSA-2009:1650 -
  • (MISC) https://access.redhat.com/errata/RHSA-2009:1649 -
Summary Cross-site scripting (XSS) vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key property and the position of quote and colon characters. CVE-2009-1380 jbossas JMX-Console cross-site-scripting in filter parameter
Information

Published : 2009-12-15 18:30

Updated : 2023-12-10 10:51

NVD link : CVE-2009-1380

Mitre link : CVE-2009-1380

CVE.ORG link : CVE-2009-1380

JSON object : View

Products Affected

redhat

  • jboss_enterprise_application_platform
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')