cvelistv5 - cve-2009-1553

CVE-2009-1553 (GCVE-0-2009-1553)

Vulnerability from cvelistv5 – Published: 2009-05-06 16:00 – Updated: 2024-08-07 05:20

Summary

Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://www.securityfocus.com/archive/1/503236/100…	mailing-listx_refsource_BUGTRAQ
	http://sunsolve.sun.com/search/document.do?assetk…	vendor-advisoryx_refsource_SUNALERT
	http://www.nabble.com/-DSECRG--Sun-Glassfish-Mult…	mailing-listx_refsource_MLIST
	http://osvdb.org/54254	vdb-entryx_refsource_OSVDB
	https://glassfish.dev.java.net/servlets/ReadMsg?l…	mailing-listx_refsource_MLIST
	http://osvdb.org/54256	vdb-entryx_refsource_OSVDB
	http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-…	mailing-listx_refsource_MLIST
	http://osvdb.org/54250	vdb-entryx_refsource_OSVDB
	http://osvdb.org/54253	vdb-entryx_refsource_OSVDB
	http://osvdb.org/54257	vdb-entryx_refsource_OSVDB
	https://glassfish.dev.java.net/servlets/ReadMsg?l…	mailing-listx_refsource_MLIST
	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
	http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-0…	third-party-advisoryx_refsource_JVNDB
	http://www.vupen.com/english/advisories/2009/1255	vdb-entryx_refsource_VUPEN
	https://glassfish.dev.java.net/servlets/ReadMsg?l…	mailing-listx_refsource_MLIST
	http://osvdb.org/54252	vdb-entryx_refsource_OSVDB
	http://osvdb.org/54255	vdb-entryx_refsource_OSVDB
	http://dsecrg.com/pages/vul/show.php?id=134	x_refsource_MISC
	http://osvdb.org/54249	vdb-entryx_refsource_OSVDB
	http://jvn.jp/en/jp/JVN73653977/index.html	third-party-advisoryx_refsource_JVN
	http://osvdb.org/54251	vdb-entryx_refsource_OSVDB
	http://www.securityfocus.com/bid/34824	vdb-entryx_refsource_BID
	http://www.securityfocus.com/bid/34914	vdb-entryx_refsource_BID

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:20:33.751Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20090505 [DSECRG-09-034] Sun Glassfish Enterprise Server - Multiple Linked XSS vulnerabilies",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/503236/100/0/threaded"
          },
          {
            "name": "258528",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1"
          },
          {
            "name": "[dev] 20090319 [DSECRG] Sun Glassfish Multiple Security Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html"
          },
          {
            "name": "54254",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/54254"
          },
          {
            "name": "[cvs] 20090322 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/docroot/configuration/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675"
          },
          {
            "name": "54256",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/54256"
          },
          {
            "name": "[dev] 20090411 Re: [DSECRG] Sun Glassfish Multiple Security Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html"
          },
          {
            "name": "54250",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/54250"
          },
          {
            "name": "54253",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/54253"
          },
          {
            "name": "54257",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/54257"
          },
          {
            "name": "[cvs] 20090320 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/docroot/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669"
          },
          {
            "name": "glassfish-jsa-admininterface-xss(50453)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50453"
          },
          {
            "name": "JVNDB-2009-000027",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVNDB",
              "x_transferred"
            ],
            "url": "http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html"
          },
          {
            "name": "ADV-2009-1255",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1255"
          },
          {
            "name": "[cvs] 20090320 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/java/com/sun/enterprise/tools/admingui/handlers/CommonHandlers.java",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668"
          },
          {
            "name": "54252",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/54252"
          },
          {
            "name": "54255",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/54255"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://dsecrg.com/pages/vul/show.php?id=134"
          },
          {
            "name": "54249",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/54249"
          },
          {
            "name": "JVN#73653977",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN73653977/index.html"
          },
          {
            "name": "54251",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/54251"
          },
          {
            "name": "34824",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34824"
          },
          {
            "name": "34914",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34914"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-05-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20090505 [DSECRG-09-034] Sun Glassfish Enterprise Server - Multiple Linked XSS vulnerabilies",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/503236/100/0/threaded"
        },
        {
          "name": "258528",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1"
        },
        {
          "name": "[dev] 20090319 [DSECRG] Sun Glassfish Multiple Security Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html"
        },
        {
          "name": "54254",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/54254"
        },
        {
          "name": "[cvs] 20090322 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/docroot/configuration/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675"
        },
        {
          "name": "54256",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/54256"
        },
        {
          "name": "[dev] 20090411 Re: [DSECRG] Sun Glassfish Multiple Security Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html"
        },
        {
          "name": "54250",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/54250"
        },
        {
          "name": "54253",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/54253"
        },
        {
          "name": "54257",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/54257"
        },
        {
          "name": "[cvs] 20090320 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/docroot/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669"
        },
        {
          "name": "glassfish-jsa-admininterface-xss(50453)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50453"
        },
        {
          "name": "JVNDB-2009-000027",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVNDB"
          ],
          "url": "http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html"
        },
        {
          "name": "ADV-2009-1255",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1255"
        },
        {
          "name": "[cvs] 20090320 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/java/com/sun/enterprise/tools/admingui/handlers/CommonHandlers.java",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668"
        },
        {
          "name": "54252",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/54252"
        },
        {
          "name": "54255",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/54255"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://dsecrg.com/pages/vul/show.php?id=134"
        },
        {
          "name": "54249",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/54249"
        },
        {
          "name": "JVN#73653977",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN73653977/index.html"
        },
        {
          "name": "54251",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/54251"
        },
        {
          "name": "34824",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34824"
        },
        {
          "name": "34914",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34914"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-1553",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20090505 [DSECRG-09-034] Sun Glassfish Enterprise Server - Multiple Linked XSS vulnerabilies",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/503236/100/0/threaded"
            },
            {
              "name": "258528",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1"
            },
            {
              "name": "[dev] 20090319 [DSECRG] Sun Glassfish Multiple Security Vulnerabilities",
              "refsource": "MLIST",
              "url": "http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html"
            },
            {
              "name": "54254",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/54254"
            },
            {
              "name": "[cvs] 20090322 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/docroot/configuration/",
              "refsource": "MLIST",
              "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675"
            },
            {
              "name": "54256",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/54256"
            },
            {
              "name": "[dev] 20090411 Re: [DSECRG] Sun Glassfish Multiple Security Vulnerabilities",
              "refsource": "MLIST",
              "url": "http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html"
            },
            {
              "name": "54250",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/54250"
            },
            {
              "name": "54253",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/54253"
            },
            {
              "name": "54257",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/54257"
            },
            {
              "name": "[cvs] 20090320 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/docroot/",
              "refsource": "MLIST",
              "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669"
            },
            {
              "name": "glassfish-jsa-admininterface-xss(50453)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50453"
            },
            {
              "name": "JVNDB-2009-000027",
              "refsource": "JVNDB",
              "url": "http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html"
            },
            {
              "name": "ADV-2009-1255",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1255"
            },
            {
              "name": "[cvs] 20090320 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/java/com/sun/enterprise/tools/admingui/handlers/CommonHandlers.java",
              "refsource": "MLIST",
              "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668"
            },
            {
              "name": "54252",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/54252"
            },
            {
              "name": "54255",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/54255"
            },
            {
              "name": "http://dsecrg.com/pages/vul/show.php?id=134",
              "refsource": "MISC",
              "url": "http://dsecrg.com/pages/vul/show.php?id=134"
            },
            {
              "name": "54249",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/54249"
            },
            {
              "name": "JVN#73653977",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN73653977/index.html"
            },
            {
              "name": "54251",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/54251"
            },
            {
              "name": "34824",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/34824"
            },
            {
              "name": "34914",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/34914"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-1553",
    "datePublished": "2009-05-06T16:00:00",
    "dateReserved": "2009-05-06T00:00:00",
    "dateUpdated": "2024-08-07T05:20:33.751Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:glassfish_server:2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DBDD6781-CF9E-4ED3-861F-99217EE0711C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.\"}, {\"lang\": \"es\", \"value\": \"M\\u00faltiples vulnerabilidades de ejecuci\\u00f3n de secuencias de comandos en sitios cruzados (XSS) en Admin Console en Sun GlassFish Enterprise Server  v2.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\\u00f3n a trav\\u00e9s de una consulta a (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, o (6) webService/webServicesGeneral.jsf; o del par\\u00e1metro \\\"name\\\" a (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.\"}]",
      "id": "CVE-2009-1553",
      "lastModified": "2024-11-21T01:02:46.013",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2009-05-06T16:30:00.517",
      "references": "[{\"url\": \"http://dsecrg.com/pages/vul/show.php?id=134\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\"]}, {\"url\": \"http://jvn.jp/en/jp/JVN73653977/index.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://osvdb.org/54249\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://osvdb.org/54250\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://osvdb.org/54251\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://osvdb.org/54252\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://osvdb.org/54253\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://osvdb.org/54254\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://osvdb.org/54255\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://osvdb.org/54256\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://osvdb.org/54257\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\"]}, {\"url\": \"http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/archive/1/503236/100/0/threaded\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/34824\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\"]}, {\"url\": \"http://www.securityfocus.com/bid/34914\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.vupen.com/english/advisories/2009/1255\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/50453\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://dsecrg.com/pages/vul/show.php?id=134\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\"]}, {\"url\": \"http://jvn.jp/en/jp/JVN73653977/index.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://osvdb.org/54249\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://osvdb.org/54250\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://osvdb.org/54251\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://osvdb.org/54252\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://osvdb.org/54253\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://osvdb.org/54254\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://osvdb.org/54255\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://osvdb.org/54256\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://osvdb.org/54257\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\"]}, {\"url\": \"http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/archive/1/503236/100/0/threaded\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/34824\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\"]}, {\"url\": \"http://www.securityfocus.com/bid/34914\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.vupen.com/english/advisories/2009/1255\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/50453\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2009-1553\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2009-05-06T16:30:00.517\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.\"},{\"lang\":\"es\",\"value\":\"M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en Admin Console en Sun GlassFish Enterprise Server  v2.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de una consulta a (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, o (6) webService/webServicesGeneral.jsf; o del par\u00e1metro \\\"name\\\" a (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:glassfish_server:2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DBDD6781-CF9E-4ED3-861F-99217EE0711C\"}]}]}],\"references\":[{\"url\":\"http://dsecrg.com/pages/vul/show.php?id=134\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\"]},{\"url\":\"http://jvn.jp/en/jp/JVN73653977/index.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/54249\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/54250\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/54251\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/54252\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/54253\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/54254\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/54255\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/54256\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/54257\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\"]},{\"url\":\"http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/503236/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/34824\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\"]},{\"url\":\"http://www.securityfocus.com/bid/34914\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/1255\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/50453\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://dsecrg.com/pages/vul/show.php?id=134\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"http://jvn.jp/en/jp/JVN73653977/index.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/54249\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/54250\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/54251\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/54252\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/54253\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/54254\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/54255\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/54256\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/54257\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/503236/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/34824\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"http://www.securityfocus.com/bid/34914\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/1255\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/50453\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
  }
}

FKIE_CVE-2009-1553

Vulnerability from fkie_nvd - Published: 2009-05-06 16:30 - Updated: 2025-04-09 00:30

Severity ?

Summary

References

URL	Tags
cve@mitre.org	http://dsecrg.com/pages/vul/show.php?id=134	Exploit
cve@mitre.org	http://jvn.jp/en/jp/JVN73653977/index.html
cve@mitre.org	http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html
cve@mitre.org	http://osvdb.org/54249
cve@mitre.org	http://osvdb.org/54250
cve@mitre.org	http://osvdb.org/54251
cve@mitre.org	http://osvdb.org/54252
cve@mitre.org	http://osvdb.org/54253
cve@mitre.org	http://osvdb.org/54254
cve@mitre.org	http://osvdb.org/54255
cve@mitre.org	http://osvdb.org/54256
cve@mitre.org	http://osvdb.org/54257
cve@mitre.org	http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1
cve@mitre.org	http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html	Exploit
cve@mitre.org	http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html
cve@mitre.org	http://www.securityfocus.com/archive/1/503236/100/0/threaded
cve@mitre.org	http://www.securityfocus.com/bid/34824	Exploit
cve@mitre.org	http://www.securityfocus.com/bid/34914
cve@mitre.org	http://www.vupen.com/english/advisories/2009/1255
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/50453
cve@mitre.org	https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29668	Patch, Vendor Advisory
cve@mitre.org	https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29669	Patch, Vendor Advisory
cve@mitre.org	https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29675	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://dsecrg.com/pages/vul/show.php?id=134	Exploit
af854a3a-2127-422b-91ae-364da2661108	http://jvn.jp/en/jp/JVN73653977/index.html
af854a3a-2127-422b-91ae-364da2661108	http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html
af854a3a-2127-422b-91ae-364da2661108	http://osvdb.org/54249
af854a3a-2127-422b-91ae-364da2661108	http://osvdb.org/54250
af854a3a-2127-422b-91ae-364da2661108	http://osvdb.org/54251
af854a3a-2127-422b-91ae-364da2661108	http://osvdb.org/54252
af854a3a-2127-422b-91ae-364da2661108	http://osvdb.org/54253
af854a3a-2127-422b-91ae-364da2661108	http://osvdb.org/54254
af854a3a-2127-422b-91ae-364da2661108	http://osvdb.org/54255
af854a3a-2127-422b-91ae-364da2661108	http://osvdb.org/54256
af854a3a-2127-422b-91ae-364da2661108	http://osvdb.org/54257
af854a3a-2127-422b-91ae-364da2661108	http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1
af854a3a-2127-422b-91ae-364da2661108	http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html	Exploit
af854a3a-2127-422b-91ae-364da2661108	http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/503236/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/34824	Exploit
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/34914
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2009/1255
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/50453
af854a3a-2127-422b-91ae-364da2661108	https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29668	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29669	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29675	Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	oracle	glassfish_server	2.1

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:glassfish_server:2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DBDD6781-CF9E-4ED3-861F-99217EE0711C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en Admin Console en Sun GlassFish Enterprise Server  v2.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de una consulta a (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, o (6) webService/webServicesGeneral.jsf; o del par\u00e1metro \"name\" a (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf."
    }
  ],
  "id": "CVE-2009-1553",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2009-05-06T16:30:00.517",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://dsecrg.com/pages/vul/show.php?id=134"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://jvn.jp/en/jp/JVN73653977/index.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54249"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54250"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54251"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54252"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54253"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54254"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54255"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54256"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54257"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/503236/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/34824"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/34914"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2009/1255"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50453"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://dsecrg.com/pages/vul/show.php?id=134"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://jvn.jp/en/jp/JVN73653977/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54249"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54250"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54251"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54252"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54253"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54254"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54255"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54256"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54257"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/503236/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/34824"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/34914"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2009/1255"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50453"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GSD-2009-1553

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2009-1553

Aliases

CVE-2009-1553

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2009-1553",
    "description": "Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.",
    "id": "GSD-2009-1553"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2009-1553"
      ],
      "details": "Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.",
      "id": "GSD-2009-1553",
      "modified": "2023-12-13T01:19:47.701637Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2009-1553",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "20090505 [DSECRG-09-034] Sun Glassfish Enterprise Server - Multiple Linked XSS vulnerabilies",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/503236/100/0/threaded"
          },
          {
            "name": "258528",
            "refsource": "SUNALERT",
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1"
          },
          {
            "name": "[dev] 20090319 [DSECRG] Sun Glassfish Multiple Security Vulnerabilities",
            "refsource": "MLIST",
            "url": "http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html"
          },
          {
            "name": "54254",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/54254"
          },
          {
            "name": "[cvs] 20090322 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/docroot/configuration/",
            "refsource": "MLIST",
            "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675"
          },
          {
            "name": "54256",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/54256"
          },
          {
            "name": "[dev] 20090411 Re: [DSECRG] Sun Glassfish Multiple Security Vulnerabilities",
            "refsource": "MLIST",
            "url": "http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html"
          },
          {
            "name": "54250",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/54250"
          },
          {
            "name": "54253",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/54253"
          },
          {
            "name": "54257",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/54257"
          },
          {
            "name": "[cvs] 20090320 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/docroot/",
            "refsource": "MLIST",
            "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669"
          },
          {
            "name": "glassfish-jsa-admininterface-xss(50453)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50453"
          },
          {
            "name": "JVNDB-2009-000027",
            "refsource": "JVNDB",
            "url": "http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html"
          },
          {
            "name": "ADV-2009-1255",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2009/1255"
          },
          {
            "name": "[cvs] 20090320 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/java/com/sun/enterprise/tools/admingui/handlers/CommonHandlers.java",
            "refsource": "MLIST",
            "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668"
          },
          {
            "name": "54252",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/54252"
          },
          {
            "name": "54255",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/54255"
          },
          {
            "name": "http://dsecrg.com/pages/vul/show.php?id=134",
            "refsource": "MISC",
            "url": "http://dsecrg.com/pages/vul/show.php?id=134"
          },
          {
            "name": "54249",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/54249"
          },
          {
            "name": "JVN#73653977",
            "refsource": "JVN",
            "url": "http://jvn.jp/en/jp/JVN73653977/index.html"
          },
          {
            "name": "54251",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/54251"
          },
          {
            "name": "34824",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/34824"
          },
          {
            "name": "34914",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/34914"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:glassfish_server:2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-1553"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[cvs] 20090320 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/docroot/",
              "refsource": "MLIST",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669"
            },
            {
              "name": "[dev] 20090411 Re: [DSECRG] Sun Glassfish Multiple Security Vulnerabilities",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html"
            },
            {
              "name": "34824",
              "refsource": "BID",
              "tags": [
                "Exploit"
              ],
              "url": "http://www.securityfocus.com/bid/34824"
            },
            {
              "name": "http://dsecrg.com/pages/vul/show.php?id=134",
              "refsource": "MISC",
              "tags": [
                "Exploit"
              ],
              "url": "http://dsecrg.com/pages/vul/show.php?id=134"
            },
            {
              "name": "[cvs] 20090320 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/java/com/sun/enterprise/tools/admingui/handlers/CommonHandlers.java",
              "refsource": "MLIST",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668"
            },
            {
              "name": "[dev] 20090319 [DSECRG] Sun Glassfish Multiple Security Vulnerabilities",
              "refsource": "MLIST",
              "tags": [
                "Exploit"
              ],
              "url": "http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html"
            },
            {
              "name": "[cvs] 20090322 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/docroot/configuration/",
              "refsource": "MLIST",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675"
            },
            {
              "name": "54255",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/54255"
            },
            {
              "name": "54250",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/54250"
            },
            {
              "name": "54249",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/54249"
            },
            {
              "name": "54256",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/54256"
            },
            {
              "name": "54254",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/54254"
            },
            {
              "name": "ADV-2009-1255",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2009/1255"
            },
            {
              "name": "54257",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/54257"
            },
            {
              "name": "54251",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/54251"
            },
            {
              "name": "54253",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/54253"
            },
            {
              "name": "54252",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/54252"
            },
            {
              "name": "JVNDB-2009-000027",
              "refsource": "JVNDB",
              "tags": [],
              "url": "http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html"
            },
            {
              "name": "258528",
              "refsource": "SUNALERT",
              "tags": [],
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1"
            },
            {
              "name": "34914",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/34914"
            },
            {
              "name": "JVN#73653977",
              "refsource": "JVN",
              "tags": [],
              "url": "http://jvn.jp/en/jp/JVN73653977/index.html"
            },
            {
              "name": "glassfish-jsa-admininterface-xss(50453)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50453"
            },
            {
              "name": "20090505 [DSECRG-09-034] Sun Glassfish Enterprise Server - Multiple Linked XSS vulnerabilies",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/503236/100/0/threaded"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        }
      },
      "lastModifiedDate": "2018-10-10T19:37Z",
      "publishedDate": "2009-05-06T16:30Z"
    }
  }
}

GHSA-54Q2-F3HP-XGGH

Vulnerability from github – Published: 2022-05-02 03:26 – Updated: 2022-05-02 03:26

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2009-1553"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-05-06T16:30:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.",
  "id": "GHSA-54q2-f3hp-xggh",
  "modified": "2022-05-02T03:26:11Z",
  "published": "2022-05-02T03:26:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1553"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50453"
    },
    {
      "type": "WEB",
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668"
    },
    {
      "type": "WEB",
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669"
    },
    {
      "type": "WEB",
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675"
    },
    {
      "type": "WEB",
      "url": "http://dsecrg.com/pages/vul/show.php?id=134"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN73653977/index.html"
    },
    {
      "type": "WEB",
      "url": "http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/54249"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/54250"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/54251"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/54252"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/54253"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/54254"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/54255"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/54256"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/54257"
    },
    {
      "type": "WEB",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1"
    },
    {
      "type": "WEB",
      "url": "http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html"
    },
    {
      "type": "WEB",
      "url": "http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/503236/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/34824"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/34914"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2009/1255"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

JVNDB-2009-000027

Vulnerability from jvndb - Published: 2009-05-13 15:37 - Updated:2009-05-13 15:37

Severity ?

() - -

Summary

Sun GlassFish Enterprise Server and Sun Java System Application Server vulnerable to cross-site scripting

Details

Sun GlassFish Enterprise Server and Sun Java System Application Server from Sun Microsystems contain a cross-site scripting vulnerability. Sun GlassFish Enterprise Server and Sun Java System Application Server are application servers from Sun Microsystems. Sun GlassFish Enterprise Server and Sun Java System Application Server contain a cross-site scripting vulnerability. According to the vendor, Sun Java System Application Server is currently distributed as the open sourced Sun GlassFish Enterprise Server. Users of the Sun Java System Application Server can obtain support only if they have a support contract. For more information, refer to the vendor's website. Please note that Sun Java System Application Server 8.x and 9.0 are not affected by this vulnerability. For more information, refer to the vendor's website. Project VEX of UBsecure, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the vendor under Information Security Early Warning Partnership.

References

Type

URL

	JVN	http://jvn.jp/en/jp/JVN73653977/index.html
	CVE	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1553
	NVD	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1553
	BID	http://www.securityfocus.com/bid/34824
	VUPEN	http://www.vupen.com/english/advisories/2009/1255
	OSVDB	http://osvdb.org/54257
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	Sun Microsystems, Inc.	Sun GlassFish Enterprise Server
	Sun Microsystems, Inc.	Sun Java System Application Server

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html",
  "dc:date": "2009-05-13T15:37+09:00",
  "dcterms:issued": "2009-05-13T15:37+09:00",
  "dcterms:modified": "2009-05-13T15:37+09:00",
  "description": "Sun GlassFish Enterprise Server and Sun Java System Application Server from Sun Microsystems contain a cross-site scripting vulnerability.\r\n\r\nSun GlassFish Enterprise Server and Sun Java System Application Server are application servers from Sun Microsystems. Sun GlassFish Enterprise Server and Sun Java System Application Server contain a cross-site scripting vulnerability.\r\n\r\nAccording to the vendor, Sun Java System Application Server is currently distributed as the open sourced Sun GlassFish Enterprise Server. Users of the Sun Java System Application Server can obtain support only if they have a support contract. For more information, refer to the vendor\u0027s website.\r\n\r\nPlease note that Sun Java System Application Server 8.x and 9.0 are not affected by this vulnerability. For more information, refer to the vendor\u0027s website. \r\n\r\nProject VEX of UBsecure, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the vendor under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:sun:glassfish_enterprise_server",
      "@product": "Sun GlassFish Enterprise Server",
      "@vendor": "Sun Microsystems, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:sun:java_system_application_server",
      "@product": "Sun Java System Application Server",
      "@vendor": "Sun Microsystems, Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "2.6",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2009-000027",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN73653977/index.html",
      "@id": "JVN#73653977",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1553",
      "@id": "CVE-2009-1553",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1553",
      "@id": "CVE-2009-1553",
      "@source": "NVD"
    },
    {
      "#text": "http://www.securityfocus.com/bid/34824",
      "@id": "34824",
      "@source": "BID"
    },
    {
      "#text": "http://www.vupen.com/english/advisories/2009/1255",
      "@id": "VUPEN/ADV-2009-1255",
      "@source": "VUPEN"
    },
    {
      "#text": "http://osvdb.org/54257",
      "@id": "54257",
      "@source": "OSVDB"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Sun GlassFish Enterprise Server and Sun Java System Application Server vulnerable to cross-site scripting"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2009-1553 (GCVE-0-2009-1553)

FKIE_CVE-2009-1553

GSD-2009-1553

GHSA-54Q2-F3HP-XGGH

JVNDB-2009-000027

Tags

Sightings

Nomenclature