CVE-2009-4237: XSS
Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8.5 allow remote attackers to inject arbitrary web script or HTML via (1) the req parameter to login.php, and allow remote authenticated users to inject arbitrary web script or HTML via (2) the key parameter to lib/general/staticPage.php, (3) the tableName parameter to lib/attachments/attachmentupload.php, or the (4) startDate, (5) endDate, or (6) logLevel parameter to lib/events/eventviewer.php; (7) the searchnotesstring parameter to lib/results/resultsMoreBuildsbuildReport.php; or the (8) expectedresults, (9) name, (10) steps, or (11) summary parameter in a find action to lib/testcases/searchData.php, related to lib/functions/database.class.php.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4237?
CVE-2009-4237 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2009-4237?
To fix CVE-2009-4237, upgrade TestLink to version 1.8.5 or later.
What versions of TestLink are affected by CVE-2009-4237?
CVE-2009-4237 affects TestLink versions prior to 1.8.5, including 1.7 and various 1.8.x release candidates.
Can CVE-2009-4237 allow remote code execution?
No, CVE-2009-4237 specifically allows for cross-site scripting, not remote code execution.
What are the potential impacts of CVE-2009-4237 exploitation?
Exploitation of CVE-2009-4237 can lead to unauthorized content injection, session hijacking, and user information theft.