CVE-2009-3030: XSS
First published: Thu Oct 15 2009(Updated: )
Cross-site scripting (XSS) vulnerability in Symantec SecurityExpressions Audit and Compliance Server 4.1.1, 4.1, and earlier allows remote attackers to inject arbitrary web script or HTML via vectors that trigger an error message in a response, related to an "HTML Injection issue."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Symantec SecurityExpressions Audit and Compliance Server | =4.1 | |
| Symantec SecurityExpressions Audit and Compliance Server | <=4.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/36972
- http://www.securityfocus.com/bid/36571
- http://www.osvdb.org/58650
- http://securitytracker.com/id?1022989
- http://www.vupen.com/english/advisories/2009/2849
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20091006_00
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53669
Frequently Asked Questions
What is the severity of CVE-2009-3030?
CVE-2009-3030 is considered a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2009-3030?
To fix CVE-2009-3030, upgrade to Symantec SecurityExpressions Audit and Compliance Server version 4.1.2 or later.
What types of attacks can CVE-2009-3030 facilitate?
CVE-2009-3030 can facilitate cross-site scripting attacks, allowing an attacker to inject malicious scripts into web pages.
Which versions of Symantec SecurityExpressions are affected by CVE-2009-3030?
CVE-2009-3030 affects Symantec SecurityExpressions Audit and Compliance Server versions 4.1 and 4.1.1, and earlier.
What are the potential impacts of exploiting CVE-2009-3030?
Exploiting CVE-2009-3030 can lead to unauthorized access, data theft, or session hijacking through injected scripts.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/remedy
- agent/author
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/symantec
- canonical/symantec securityexpressions audit and compliance server
- version/symantec securityexpressions audit and compliance server/4.1
- version/symantec securityexpressions audit and compliance server/4.1.1