CVE-2009-3731: XSS
First published: Wed Dec 16 2009(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WebWorks Help | =4.0 | |
| WebWorks Help | =2.0 | |
| WebWorks Publisher | =2003 | |
| WebWorks Publisher | =8.0 | |
| WebWorks ePublisher | =2009.2 | |
| WebWorks ePublisher | =2008.2 | |
| WebWorks ePublisher | =2009.1 | |
| WebWorks ePublisher | =9.1 | |
| WebWorks Publisher | =6.0 | |
| WebWorks ePublisher | =2008.1 | |
| WebWorks ePublisher | =9.0 | |
| WebWorks ePublisher | =2008.3 | |
| WebWorks ePublisher | =9.3 | |
| WebWorks Publisher | =7.0 | |
| WebWorks ePublisher | =9.2 | |
| WebWorks Help | =5.0 | |
| WebWorks Help | =3.0 | |
| WebWorks ePublisher | =2008.4 | |
| VMware vCenter Lab Manager | =3.0.1 | |
| VMware vCenter Lab Manager | =3.0.2 | |
| VMware Stage Manager | =1.0 | |
| Vmware Vcenter Stage Manager | =1.0.1 | |
| VMware Lab Manager | =2.0 | |
| VMware Server | =2.0.2 | |
| VMware Stage Manager | <=4.0 | |
| VMware vCenter Lab Manager | =3.0 | |
| VMware ESX Server | =4.0 | |
| VMware vCenter Lab Manager | =4.0 | |
| VMware vCenter | =4.0 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.vmware.com/pipermail/security-announce/2009/000073.html
- http://www.securityfocus.com/bid/37346
- http://www.webworks.com/Security/2009-0001/
- http://archives.neohapsis.com/archives/bugtraq/2009-12/0229.html
- http://www.osvdb.org/62738
- http://secunia.com/advisories/38749
- http://www.osvdb.org/62741
- http://secunia.com/advisories/38842
- http://www.osvdb.org/62739
- http://www.osvdb.org/62740
- http://www.osvdb.org/62742
- http://securitytracker.com/id?1023683
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5944
- http://www.securityfocus.com/archive/1/509883/100/0/threaded
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/remedy
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/webworks
- canonical/webworks help
- version/webworks help/4.0
- version/webworks help/2.0
- canonical/webworks publisher
- version/webworks publisher/2003
- version/webworks publisher/8.0
- canonical/webworks epublisher
- version/webworks epublisher/2009.2
- version/webworks epublisher/2008.2
- version/webworks epublisher/2009.1
- version/webworks epublisher/9.1
- version/webworks publisher/6.0
- version/webworks epublisher/2008.1
- version/webworks epublisher/9.0
- version/webworks epublisher/2008.3
- version/webworks epublisher/9.3
- version/webworks publisher/7.0
- version/webworks epublisher/9.2
- version/webworks help/5.0
- version/webworks help/3.0
- version/webworks epublisher/2008.4
- vendor/vmware
- canonical/vmware vcenter lab manager
- version/vmware vcenter lab manager/3.0.1
- version/vmware vcenter lab manager/3.0.2
- canonical/vmware stage manager
- version/vmware stage manager/1.0
- canonical/vmware vcenter stage manager
- version/vmware vcenter stage manager/1.0.1
- canonical/vmware lab manager
- version/vmware lab manager/2.0
- canonical/vmware server
- version/vmware server/2.0.2
- version/vmware stage manager/4.0
- version/vmware vcenter lab manager/3.0
- canonical/vmware esx server
- version/vmware esx server/4.0
- version/vmware vcenter lab manager/4.0
- canonical/vmware vcenter
- version/vmware vcenter/4.0
- vendor/microsoft
- canonical/microsoft windows