CVE-2009-2696: XSS
First published: Wed Jul 21 2010(Updated: )
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/tomcat5 | <0:5.5.23-0jpp.9.el5_5 | 0:5.5.23-0jpp.9.el5_5 |
| Apache Tomcat | <=4.1.39 | |
| Redhat Desktop Workstation | =5 | |
| Redhat Enterprise Linux | =5 | |
| Redhat Enterprise Linux Desktop | =5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=616717
- http://secunia.com/advisories/40813
- http://www.redhat.com/support/errata/RHSA-2010-0580.html
- http://www.vupen.com/english/advisories/2010/1986
- https://access.redhat.com/security/cve/CVE-2009-0781
- https://access.redhat.com/security/cve/CVE-2009-2696
- https://rhn.redhat.com/errata/RHSA-2010-0580.html
- https://www.cve.org/CVERecord?id=CVE-2009-2696 https://nvd.nist.gov/vuln/detail/CVE-2009-2696
- https://access.redhat.com/errata/RHSA-2010:0580
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-2696.json
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-2696
- agent/weakness
- agent/author
- agent/severity
- agent/references
- agent/description
- collector/redhat-cve
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- vendor/apache
- canonical/apache tomcat
- version/apache tomcat/4.1.39
- vendor/redhat
- canonical/redhat desktop workstation
- version/redhat desktop workstation/5
- canonical/redhat enterprise linux
- version/redhat enterprise linux/5
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/5.0
- package-manager/redhat