Lucene search

[email protected]CVE-2009-4473

HistoryDec 30, 2009 - 9:30 p.m.

CVE-2009-4473

2009-12-3021:30:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2009-4473

cross-site scripting

xss

ektron cms400.net

security vulnerability

remote attack

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

62.2%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in WorkArea/ContentDesigner/ekformsiframe.aspx in Ektron CMS400.NET 7.6.1.53 and 7.6.6.47, and possibly 7.52 through 7.66sp2, allow remote attackers to inject arbitrary web script or HTML via the (1) css, (2) eca, (3) id, and (4) skin parameters. NOTE: some of these details are obtained from third party information.

Affected configurations

NVD

Node

ektroncms4000.netMatch7.6.0

ektroncms4000.netMatch7.6.0sp1

ektroncms4000.netMatch7.6.0sp2

ektroncms4000.netMatch7.6.1

ektroncms4000.netMatch7.6.1sp1

ektroncms4000.netMatch7.6.1sp2

ektroncms4000.netMatch7.6.1sp3

ektroncms4000.netMatch7.6.1sp4

ektroncms4000.netMatch7.6.1.53

ektroncms4000.netMatch7.6.5

ektroncms4000.netMatch7.6.5sp1

ektroncms4000.netMatch7.6.5sp2

ektroncms4000.netMatch7.6.5sp3

ektroncms4000.netMatch7.6.6

ektroncms4000.netMatch7.6.6sp1

ektroncms4000.netMatch7.6.6sp2

ektroncms4000.netMatch7.6.6.47

ektroncms4000.netMatch7.52

ektroncms4000.netMatch7.53

ektroncms4000.netMatch7.53sp2

ektroncms4000.netMatch7.54

ektroncms4000.netMatch7.54sp2

CPENameOperatorVersion
ektron:cms4000.netektron cms4000.neteq7.6.0
ektron:cms4000.netektron cms4000.neteq7.6.1
ektron:cms4000.netektron cms4000.neteq7.6.1.53
ektron:cms4000.netektron cms4000.neteq7.6.5
ektron:cms4000.netektron cms4000.neteq7.6.6
ektron:cms4000.netektron cms4000.neteq7.6.6.47
ektron:cms4000.netektron cms4000.neteq7.52
ektron:cms4000.netektron cms4000.neteq7.53
ektron:cms4000.netektron cms4000.neteq7.54

CPE	Name	Operator	Version
ektron:cms4000.net	ektron cms4000.net	eq	7.6.0
ektron:cms4000.net	ektron cms4000.net	eq	7.6.1
ektron:cms4000.net	ektron cms4000.net	eq	7.6.1.53
ektron:cms4000.net	ektron cms4000.net	eq	7.6.5
ektron:cms4000.net	ektron cms4000.net	eq	7.6.6
ektron:cms4000.net	ektron cms4000.net	eq	7.6.6.47
ektron:cms4000.net	ektron cms4000.net	eq	7.52
ektron:cms4000.net	ektron cms4000.net	eq	7.53
ektron:cms4000.net	ektron cms4000.net	eq	7.54

References

dev.ektron.com/forum.aspx?g=posts&t=28048

dev.ektron.com/notices.aspx?id=19074

osvdb.org/57667

secunia.com/advisories/36591

www.securityfocus.com/bid/36279

exchange.xforce.ibmcloud.com/vulnerabilities/53043

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

62.2%

JSON

Related for CVE-2009-4473

cvelist1 prion1 nessus1 nvd1