CVE-2009-2163: XSS
Published Jun 22, 2009
·Updated
Cross-site scripting (XSS) vulnerability in login/default.aspx in Sitecore CMS before 6.0.2 Update-1 090507 allows remote attackers to inject arbitrary web script or HTML via the scerror parameter.
Affected Software
4 affected components
Sitecore CMS<=6.0.2
Sitecore CMS=5.3.0
Sitecore CMS=5.3.1
Sitecore CMS=6.0.1
Event History
Jun 22, 2009
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2163?
CVE-2009-2163 is classified as a moderate severity Cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2009-2163?
To fix CVE-2009-2163, upgrade Sitecore CMS to version 6.0.2 Update-1 090507 or later.
3
Which versions of Sitecore CMS are affected by CVE-2009-2163?
CVE-2009-2163 affects Sitecore CMS versions earlier than 6.0.2 Update-1 as well as versions 5.3.0 and 5.3.1.
4
What type of vulnerability is CVE-2009-2163?
CVE-2009-2163 is a Cross-site scripting (XSS) vulnerability that allows injection of arbitrary web scripts.
5
Can CVE-2009-2163 be exploited remotely?
Yes, CVE-2009-2163 can be exploited remotely by attackers using the sc_error parameter.