CVE-2009-1294: XSS

Published Apr 16, 2009

Updated

Multiple cross-site scripting (XSS) vulnerabilities in web/guest/home in the Liferay 4.3.0 portal in Novell Teaming 1.0 through SP3 (1.0.3) allow remote attackers to inject arbitrary web script or HTML via the (1) ppstate or (2) ppmode parameters.

Affected Software

5 affected components

Novell Teaming=1.0

Novell Teaming=1.0.1

Novell Teaming=1.0.2

Novell Teaming=1.0.3

Liferay Liferay Enterprise Portal=4.3.0

Remediation

Patch Available

http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7002999&sliceId=1&docTypeID=DT_TID_1_1&dialogID=33090060&stateId=1%200%2033084737

Event History

Apr 16, 2009

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Data Sourced

03:12 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-1294?

CVE-2009-1294 is classified as having a moderate severity due to multiple cross-site scripting vulnerabilities.

How do I fix CVE-2009-1294?

To fix CVE-2009-1294, you should upgrade to a patched version of Novell Teaming or Liferay that addresses the XSS vulnerabilities.

What software is affected by CVE-2009-1294?

CVE-2009-1294 affects Novell Teaming versions 1.0 through 1.0.3 and Liferay 4.3.0.

What are the typical attack vectors for CVE-2009-1294?

Attackers can exploit CVE-2009-1294 by injecting arbitrary web scripts or HTML through the p_p_state or p_p_mode parameters.

Is user input filtration effective against CVE-2009-1294?

Using input validation and proper output encoding can help mitigate risks associated with CVE-2009-1294.