Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-4052

Multiple cross-site scripting (XSS) vulnerabilities in the JSF Widget Library Runtime in IBM Rational Application Developer for WebSphere Software before 7.0.0.10 and Rational Software Architect before 7.0.0.10 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) the JSF Tree Control and (2) the JavaScript Resource Servlet.

Published

2009-11-23T17:30:00.750

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ibm	rational_application_developer_for_websphere	7.0	Yes
Application	ibm	rational_application_developer_for_websphere	7.0.0.1	Yes
Application	ibm	rational_application_developer_for_websphere	7.0.0.2	Yes
Application	ibm	rational_application_developer_for_websphere	7.0.0.3	Yes
Application	ibm	rational_application_developer_for_websphere	7.0.0.4	Yes
Application	ibm	rational_application_developer_for_websphere	7.0.0.5	Yes
Application	ibm	rational_application_developer_for_websphere	7.0.0.6	Yes
Application	ibm	rational_application_developer_for_websphere	7.0.0.7	Yes
Application	ibm	rational_application_developer_for_websphere	7.0.0.8	Yes
Application	ibm	rational_application_developer_for_websphere	7.0.0.9	Yes
Application	ibm	rational_software_architect	7.0.0.0	Yes
Application	ibm	rational_software_architect	7.0.0.1	Yes
Application	ibm	rational_software_architect	7.0.0.2	Yes
Application	ibm	rational_software_architect	7.0.0.3	Yes
Application	ibm	rational_software_architect	7.0.0.4	Yes
Application	ibm	rational_software_architect	7.0.0.5	Yes
Application	ibm	rational_software_architect	7.0.0.6	Yes
Application	ibm	rational_software_architect	7.0.0.7	Yes
Application	ibm	rational_software_architect	7.0.0.8	Yes
Application	ibm	rational_software_architect	7.0.0.9	Yes

References

http://secunia.com/advisories/37442 Vendor Advisory ([email protected])
http://www-01.ibm.com/support/docview.wss?uid=swg1PK90616 Vendor Advisory ([email protected])
http://www-01.ibm.com/support/docview.wss?uid=swg1PK94324 Vendor Advisory ([email protected])
http://www-01.ibm.com/support/docview.wss?uid=swg27012378 Patch ([email protected])
http://www-01.ibm.com/support/docview.wss?uid=swg27012558 Patch ([email protected])
http://www.osvdb.org/60319 ([email protected])
http://www.securityfocus.com/bid/37083 ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/54360 ([email protected])
http://secunia.com/advisories/37442 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?uid=swg1PK90616 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?uid=swg1PK94324 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?uid=swg27012378 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?uid=swg27012558 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.osvdb.org/60319 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/37083 (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/54360 (af854a3a-2127-422b-91ae-364da2661108)