Lucene search

MitreCVE-2009-4848

HistoryMay 07, 2010 - 6:30 p.m.

CVE-2009-4848

2010-05-0718:30:01

CWE-79

mitre

web.nvd.nist.gov

cve-2009-4848

xss

cross-site scripting

toutvirtual

virtualiq pro

web security

vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.9

Confidence

High

EPSS

0.002

Percentile

57.6%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to inject arbitrary web script or HTML via the (1) userId parameter to tvserver/server/user/setPermissions.jsp, (2) deptName parameter to tvserver/server/user/addDepartment.jsp, (3) ID parameter to tvserver/server/inventory/inventoryTabs.jsp, (4) reportName parameter to tvserver/reports/virtualIQAdminReports.do, or (5) middleName parameter in a save action to tvserver/user/user.do.

Affected configurations

Nvd

Node

toutvirtualvirtualiqMatch3.2-pro

toutvirtualvirtualiqMatch3.5-pro

VendorProductVersionCPE
toutvirtualvirtualiq3.2cpe:2.3:a:toutvirtual:virtualiq:3.2:-:pro:*:*:*:*:*
toutvirtualvirtualiq3.5cpe:2.3:a:toutvirtual:virtualiq:3.5:-:pro:*:*:*:*:*

Vendor	Product	Version	CPE
toutvirtual	virtualiq	3.2	cpe:2.3:a:toutvirtual:virtualiq:3.2:-:pro:::::*
toutvirtual	virtualiq	3.5	cpe:2.3:a:toutvirtual:virtualiq:3.5:-:pro:::::*

References

secunia.com/advisories/37359

www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt

www.securityfocus.com/archive/1/507729/100/0/threaded

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.9

Confidence

High

EPSS

0.002

Percentile

57.6%

JSON

Related for CVE-2009-4848