CVE-2009-3789: XSS
Multiple cross-site scripting (XSS) vulnerabilities in OpenDocMan 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the lastmessage parameter to (1) add.php, (2) toBePublished.php, (3) index.php, and (4) admin.php; the PATHINFO to the default URI to (5) category.php, (6) department.php, (7) profile.php, (8) rejects.php, (9) search.php, (10) toBePublished.php, (11) user.php, and (12) viewfile.php; and (13) the caller parameter in a Modify User action to user.php.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3789?
CVE-2009-3789 is categorized as a medium severity vulnerability due to its potential impact on web applications through cross-site scripting.
How do I fix CVE-2009-3789?
To fix CVE-2009-3789, update OpenDocMan to the latest version or apply patches that address the cross-site scripting vulnerabilities.
Which versions of OpenDocMan are affected by CVE-2009-3789?
CVE-2009-3789 specifically affects OpenDocMan version 1.2.5.
Can CVE-2009-3789 lead to data theft?
Yes, CVE-2009-3789 can lead to data theft by allowing attackers to execute malicious scripts on the affected application.
What types of attacks can be performed due to CVE-2009-3789?
CVE-2009-3789 allows for various attacks, primarily cross-site scripting (XSS), which can compromise user data and session integrity.