CVE-2009-2405: XSS
First published: Tue Jul 07 2009(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in the Web Console in the Application Server in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2.0 before 4.2.0.CP08, 4.2.2GA, 4.3 before 4.3.0.CP07, and 5.1.0GA allow remote attackers to inject arbitrary web script or HTML via the (1) monitorName, (2) objectName, (3) attribute, or (4) period parameter to createSnapshot.jsp, or the (5) monitorName, (6) objectName, (7) attribute, (8) threshold, (9) period, or (10) enabled parameter to createThresholdMonitor.jsp. NOTE: some of these details are obtained from third party information.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Jboss Enterprise Application Platform | =4.3-cp01 | |
| Redhat Jboss Enterprise Application Platform | =5.1.0-ga | |
| Redhat Jboss Enterprise Application Platform | =4.2-cp03 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp01 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp06 | |
| Redhat Jboss Enterprise Application Platform | =4.2 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp01 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp05 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp04 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp04 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp03 | |
| Redhat Jboss Enterprise Application Platform | =4.3 | |
| Redhat Jboss Enterprise Application Platform | =4.2-cp02 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp07 | |
| Redhat Jboss Enterprise Application Platform | =4.2-cp01 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp03 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp02 | |
| Redhat Jboss Enterprise Application Platform | =4.2.2-ga | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp02 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=510023
- https://jira.jboss.org/jira/browse/JBPAPP-2274
- https://rhn.redhat.com/errata/RHSA-2009-1650.html
- https://rhn.redhat.com/errata/RHSA-2009-1637.html
- https://rhn.redhat.com/errata/RHSA-2009-1636.html
- http://secunia.com/advisories/37671
- http://secunia.com/advisories/35680
- http://www.securityfocus.com/bid/37276
- http://www.osvdb.org/60899
- https://jira.jboss.org/jira/browse/JBAS-7105
- http://securitytracker.com/id?1023315
- https://jira.jboss.org/jira/browse/JBPAPP-2284
- https://rhn.redhat.com/errata/RHSA-2009-1649.html
- http://www.osvdb.org/60898
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54700
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=351481&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=351481&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=354047&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=354047&action=edit
- collector/nvd-historical
- collector/nvd-index
- collector/nvd-api
- agent/author
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/tags
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-2405
- vendor/redhat
- canonical/redhat jboss enterprise application platform
- version/redhat jboss enterprise application platform/4.3-cp01
- version/redhat jboss enterprise application platform/5.1.0-ga
- version/redhat jboss enterprise application platform/4.2-cp03
- version/redhat jboss enterprise application platform/4.2.0-cp01
- version/redhat jboss enterprise application platform/4.2.0-cp06
- version/redhat jboss enterprise application platform/4.2
- version/redhat jboss enterprise application platform/4.3.0-cp01
- version/redhat jboss enterprise application platform/4.2.0-cp05
- version/redhat jboss enterprise application platform/4.2.0-cp04
- version/redhat jboss enterprise application platform/4.3.0-cp04
- version/redhat jboss enterprise application platform/4.2.0-cp03
- version/redhat jboss enterprise application platform/4.3
- version/redhat jboss enterprise application platform/4.2-cp02
- version/redhat jboss enterprise application platform/4.2.0-cp07
- version/redhat jboss enterprise application platform/4.2-cp01
- version/redhat jboss enterprise application platform/4.3.0-cp03
- version/redhat jboss enterprise application platform/4.3.0-cp02
- version/redhat jboss enterprise application platform/4.2.2-ga
- version/redhat jboss enterprise application platform/4.2.0-cp02