CVE-2009-2405: XSS
Multiple cross-site scripting (XSS) vulnerabilities in the Web Console in the Application Server in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2.0 before 4.2.0.CP08, 4.2.2GA, 4.3 before 4.3.0.CP07, and 5.1.0GA allow remote attackers to inject arbitrary web script or HTML via the (1) monitorName, (2) objectName, (3) attribute, or (4) period parameter to createSnapshot.jsp, or the (5) monitorName, (6) objectName, (7) attribute, (8) threshold, (9) period, or (10) enabled parameter to createThresholdMonitor.jsp. NOTE: some of these details are obtained from third party information.
Other sources
We have received information from a third party regarding vulnerabilities in JBoss Application Server.
Input passed to the "monitorName", "objectName", "attribute", and "period" parameters in createSnapshot.jsp and to the "monitorName", "objectName", "attribute", "threshold", "period", and "enabled" parameters in createThresholdMonitor.jsp of the JBoss Web Console is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerabilties are confirmed in version 5.1.0GA. Other versions may also be affected.
The preliminary disclosure date has been set to July 22th, 2009.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2405?
The severity of CVE-2009-2405 is classified as medium risk due to its potential for cross-site scripting (XSS) vulnerabilities.
How do I fix CVE-2009-2405?
To mitigate CVE-2009-2405, upgrade to a patched version of Red Hat JBoss Enterprise Application Platform that addresses these XSS vulnerabilities.
What are the affected versions for CVE-2009-2405?
CVE-2009-2405 affects multiple versions of Red Hat JBoss Enterprise Application Platform, including versions prior to 4.2.0.CP08, 4.2.2GA, and 5.1.0GA.
Can CVE-2009-2405 be exploited remotely?
Yes, CVE-2009-2405 can be exploited remotely by attackers injecting arbitrary web scripts via the affected Web Console.
What types of attacks are possible with CVE-2009-2405?
CVE-2009-2405 allows attackers to conduct cross-site scripting (XSS) attacks, potentially compromising user accounts and data privacy.