CVE-2009-2405: XSS
First published: Tue Jul 07 2009(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in the Web Console in the Application Server in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2.0 before 4.2.0.CP08, 4.2.2GA, 4.3 before 4.3.0.CP07, and 5.1.0GA allow remote attackers to inject arbitrary web script or HTML via the (1) monitorName, (2) objectName, (3) attribute, or (4) period parameter to createSnapshot.jsp, or the (5) monitorName, (6) objectName, (7) attribute, (8) threshold, (9) period, or (10) enabled parameter to createThresholdMonitor.jsp. NOTE: some of these details are obtained from third party information.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| JBoss Enterprise Application Platform | =4.2 | |
| JBoss Enterprise Application Platform | =4.2-cp01 | |
| JBoss Enterprise Application Platform | =4.2-cp02 | |
| JBoss Enterprise Application Platform | =4.2-cp03 | |
| JBoss Enterprise Application Platform | =4.2.0-cp01 | |
| JBoss Enterprise Application Platform | =4.2.0-cp02 | |
| JBoss Enterprise Application Platform | =4.2.0-cp03 | |
| JBoss Enterprise Application Platform | =4.2.0-cp04 | |
| JBoss Enterprise Application Platform | =4.2.0-cp05 | |
| JBoss Enterprise Application Platform | =4.2.0-cp06 | |
| JBoss Enterprise Application Platform | =4.2.0-cp07 | |
| JBoss Enterprise Application Platform | =4.2.2-ga | |
| JBoss Enterprise Application Platform | =4.3 | |
| JBoss Enterprise Application Platform | =4.3-cp01 | |
| JBoss Enterprise Application Platform | =4.3.0-cp01 | |
| JBoss Enterprise Application Platform | =4.3.0-cp02 | |
| JBoss Enterprise Application Platform | =4.3.0-cp03 | |
| JBoss Enterprise Application Platform | =4.3.0-cp04 | |
| JBoss Enterprise Application Platform | =5.1.0-ga |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=510023
- https://jira.jboss.org/jira/browse/JBPAPP-2274
- https://rhn.redhat.com/errata/RHSA-2009-1650.html
- https://rhn.redhat.com/errata/RHSA-2009-1637.html
- https://rhn.redhat.com/errata/RHSA-2009-1636.html
- http://secunia.com/advisories/37671
- http://secunia.com/advisories/35680
- http://www.securityfocus.com/bid/37276
- http://www.osvdb.org/60899
- https://jira.jboss.org/jira/browse/JBAS-7105
- http://securitytracker.com/id?1023315
- https://jira.jboss.org/jira/browse/JBPAPP-2284
- https://rhn.redhat.com/errata/RHSA-2009-1649.html
- http://www.osvdb.org/60898
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54700
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=351481&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=351481&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=354047&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=354047&action=edit
Frequently Asked Questions
What is the severity of CVE-2009-2405?
The severity of CVE-2009-2405 is classified as medium risk due to its potential for cross-site scripting (XSS) vulnerabilities.
How do I fix CVE-2009-2405?
To mitigate CVE-2009-2405, upgrade to a patched version of Red Hat JBoss Enterprise Application Platform that addresses these XSS vulnerabilities.
What are the affected versions for CVE-2009-2405?
CVE-2009-2405 affects multiple versions of Red Hat JBoss Enterprise Application Platform, including versions prior to 4.2.0.CP08, 4.2.2GA, and 5.1.0GA.
Can CVE-2009-2405 be exploited remotely?
Yes, CVE-2009-2405 can be exploited remotely by attackers injecting arbitrary web scripts via the affected Web Console.
What types of attacks are possible with CVE-2009-2405?
CVE-2009-2405 allows attackers to conduct cross-site scripting (XSS) attacks, potentially compromising user accounts and data privacy.
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-2405
- agent/trending
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- agent/author
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-historical
- collector/nvd-index
- vendor/redhat
- canonical/jboss enterprise application platform
- version/jboss enterprise application platform/4.2
- version/jboss enterprise application platform/4.2-cp01
- version/jboss enterprise application platform/4.2-cp02
- version/jboss enterprise application platform/4.2-cp03
- version/jboss enterprise application platform/4.2.0-cp01
- version/jboss enterprise application platform/4.2.0-cp02
- version/jboss enterprise application platform/4.2.0-cp03
- version/jboss enterprise application platform/4.2.0-cp04
- version/jboss enterprise application platform/4.2.0-cp05
- version/jboss enterprise application platform/4.2.0-cp06
- version/jboss enterprise application platform/4.2.0-cp07
- version/jboss enterprise application platform/4.2.2-ga
- version/jboss enterprise application platform/4.3
- version/jboss enterprise application platform/4.3-cp01
- version/jboss enterprise application platform/4.3.0-cp01
- version/jboss enterprise application platform/4.3.0-cp02
- version/jboss enterprise application platform/4.3.0-cp03
- version/jboss enterprise application platform/4.3.0-cp04
- version/jboss enterprise application platform/5.1.0-ga