CVE-2009-1380: XSS
First published: Tue Jul 14 2009(Updated: )
Cross-site scripting (XSS) vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key property and the position of quote and colon characters.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Jboss Enterprise Application Platform | =4.3-cp01 | |
| Redhat Jboss Enterprise Application Platform | =4.2-cp03 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp01 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp06 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp01 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp05 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp04 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp04 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp03 | |
| Redhat Jboss Enterprise Application Platform | =4.2-cp02 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp07 | |
| Redhat Jboss Enterprise Application Platform | =4.2-cp01 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp03 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp02 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp02 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://securitytracker.com/id?1023315
- https://jira.jboss.org/jira/browse/JBPAPP-1983
- http://secunia.com/advisories/37671
- https://rhn.redhat.com/errata/RHSA-2009-1637.html
- https://rhn.redhat.com/errata/RHSA-2009-1636.html
- https://rhn.redhat.com/errata/RHSA-2009-1650.html
- http://www.securityfocus.com/bid/37276
- https://rhn.redhat.com/errata/RHSA-2009-1649.html
- https://bugzilla.redhat.com/show_bug.cgi?id=511224
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54698
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/tags
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-1380
- vendor/redhat
- canonical/redhat jboss enterprise application platform
- version/redhat jboss enterprise application platform/4.3-cp01
- version/redhat jboss enterprise application platform/4.2-cp03
- version/redhat jboss enterprise application platform/4.2.0-cp01
- version/redhat jboss enterprise application platform/4.2.0-cp06
- version/redhat jboss enterprise application platform/4.3.0-cp01
- version/redhat jboss enterprise application platform/4.2.0-cp05
- version/redhat jboss enterprise application platform/4.2.0-cp04
- version/redhat jboss enterprise application platform/4.3.0-cp04
- version/redhat jboss enterprise application platform/4.2.0-cp03
- version/redhat jboss enterprise application platform/4.2-cp02
- version/redhat jboss enterprise application platform/4.2.0-cp07
- version/redhat jboss enterprise application platform/4.2-cp01
- version/redhat jboss enterprise application platform/4.3.0-cp03
- version/redhat jboss enterprise application platform/4.3.0-cp02
- version/redhat jboss enterprise application platform/4.2.0-cp02