CVE-2009-0237: XSS
First published: Wed Apr 15 2009(Updated: )
Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote attackers to inject arbitrary web script or HTML via "authentication input" to this component, aka "Cross-Site Scripting Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Internet Security And Acceleration Server | =2006-supportability | |
| Microsoft Internet Security And Acceleration Server | =2004-sp3 | |
| Microsoft Forefront Threat Management Gateway | ||
| Microsoft Internet Security And Acceleration Server | =2006-sp1 | |
| Microsoft Internet Security And Acceleration Server | =2004-sp3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://osvdb.org/53637
- http://secunia.com/advisories/34687
- http://www.us-cert.gov/cas/techalerts/TA09-104A.html
- http://www.securitytracker.com/id?1022046
- http://www.vupen.com/english/advisories/2009/1030
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5771
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-016
- collector/nvd-historical
- collector/nvd-index
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- vendor/microsoft
- canonical/microsoft internet security and acceleration server
- version/microsoft internet security and acceleration server/2006-supportability
- version/microsoft internet security and acceleration server/2004-sp3
- canonical/microsoft forefront threat management gateway
- version/microsoft internet security and acceleration server/2006-sp1