Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-2897

Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from (1) the typeId parameter to mastheadAttach.do, (2) the eid parameter to Resource.do, and (3) the u parameter in a view action to admin/user/UserAdmin.do. NOTE: some of these details are obtained from third party information.

Published

2009-10-13T10:30:00.500

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application springsource application_management_suite 2.0.0 Yes
Application springsource hyperic_hq 3.2 Yes
Application springsource hyperic_hq 3.2.0 Yes
Application springsource hyperic_hq 3.2.1 Yes
Application springsource hyperic_hq 3.2.2 Yes
Application springsource hyperic_hq 3.2.3 Yes
Application springsource hyperic_hq 3.2.4 Yes
Application springsource hyperic_hq 3.2.5 Yes
Application springsource hyperic_hq 3.2.6 Yes
Application springsource hyperic_hq 4.0.0 Yes
Application springsource hyperic_hq 4.0.1 Yes
Application springsource hyperic_hq 4.0.2 Yes
Application springsource hyperic_hq 4.0.3 Yes
Application springsource hyperic_hq 4.1.0 Yes
Application springsource hyperic_hq 4.1.1 Yes
Application springsource hyperic_hq 4.1.2 Yes
Application springsource hyperic_hq 4.2 Yes
Application springsource tc_server 6.0.20 Yes
References