CVE-2009-3757: XSS
Multiple cross-site scripting (XSS) vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter to config/edituser.php; (2) location, (3) sessionid, and (4) vmname parameters to console.php; (5) vmrefid and (6) vmname parameters to forcerestart.php; and (7) vmname and (8) vmrefid parameters to forcesd.php. NOTE: some of these details are obtained from third party information.
Affected Software
Event History
Frequently Asked Questions
What are the types of vulnerabilities found in CVE-2009-3757?
CVE-2009-3757 is associated with multiple cross-site scripting (XSS) vulnerabilities that allow the injection of arbitrary web scripts or HTML.
How can attackers exploit CVE-2009-3757?
Attackers can exploit CVE-2009-3757 by manipulating the username, location, sessionid, and vmname parameters in the Citrix XenCenterWeb application.
What is the impact of CVE-2009-3757 on affected systems?
The impact of CVE-2009-3757 includes potential unauthorized access to user session data and the ability to execute malicious scripts in the context of users' browsers.
What versions of Citrix XenCenterWeb are affected by CVE-2009-3757?
CVE-2009-3757 affects all versions of Citrix XenCenterWeb that utilize the sample code containing the vulnerabilities.
What steps can be taken to mitigate CVE-2009-3757 vulnerabilities?
To mitigate CVE-2009-3757, it is recommended to sanitize user input and implement proper validation for the affected parameters.