CVE-2009-3892

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2009-3892
Cross-site scripting (XSS) vulnerability in Best Practical Solutions RT 3.6.x before 3.6.9, 3.8.x before 3.8.5, and other 3.4.6 through 3.8.4 versions allows remote attackers to inject arbitrary web script or HTML via certain Custom Fields.

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546778
http://lists.bestpractical.com/pipermail/rt-announce/2009-September/000172.html Patch
http://lists.bestpractical.com/pipermail/rt-announce/2009-September/000173.html Patch
http://www.openwall.com/lists/oss-security/2009/11/15/1
http://www.openwall.com/lists/oss-security/2009/11/16/4
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:bestpractical:rt:3.4.6:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.6.0:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.6.1:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.6.2:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.6.3:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.6.4:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.6.5:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.6.6:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.6.7:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.6.8:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.0:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.1:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.2:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.3:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.4:*:*:*:*:*:*:*
History

13 Feb 2023, 01:17

Type Values Removed Values Added
Summary CVE-2009-3892 Request Tracker XSS flaw Cross-site scripting (XSS) vulnerability in Best Practical Solutions RT 3.6.x before 3.6.9, 3.8.x before 3.8.5, and other 3.4.6 through 3.8.4 versions allows remote attackers to inject arbitrary web script or HTML via certain Custom Fields.
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2009-3892', 'name': 'https://access.redhat.com/security/cve/CVE-2009-3892', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=538173', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=538173', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 17:16

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2009-3892 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=538173 -
Summary Cross-site scripting (XSS) vulnerability in Best Practical Solutions RT 3.6.x before 3.6.9, 3.8.x before 3.8.5, and other 3.4.6 through 3.8.4 versions allows remote attackers to inject arbitrary web script or HTML via certain Custom Fields. CVE-2009-3892 Request Tracker XSS flaw
Information

Published : 2009-11-17 18:30

Updated : 2023-12-10 10:51

NVD link : CVE-2009-3892

Mitre link : CVE-2009-3892

CVE.ORG link : CVE-2009-3892

JSON object : View

Products Affected

bestpractical

  • rt
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')