var-200902-0563
Vulnerability from variot
Cross-site scripting (XSS) vulnerability in Adobe RoboHelp Server 6 and 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled when displaying the Help Errors log. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Adobe RoboHelp Server 6 and 7 are vulnerable. ----------------------------------------------------------------------
Did you know? Our assessment and impact rating along with detailed information such as exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list?
Click here to learn more about our commercial solutions: http://secunia.com/advisories/business_solutions/
Click here to trial our solutions: http://secunia.com/advisories/try_vi/
TITLE: Adobe RoboHelp Server Cross-Site Scripting Vulnerabilities
SECUNIA ADVISORY ID: SA34048
VERIFY ADVISORY: http://secunia.com/advisories/34048/
DESCRIPTION: Some vulnerabilities have been reported in Adobe RoboHelp Server, which can be exploited by malicious people to conduct cross-site scripting attacks.
1) Certain unspecified input is not properly sanitised before being returned to the user.
Successful exploitation requires that the attacker has access to the RoboHelp Help Errors log or is able to trick a victim possessing the required permissions into following a malicious URL.
2) Input passed to unspecified parameters is not properly sanitised before being returned to the user.
SOLUTION: Apply patches and regenerate the RoboHelp content. See vendor's advisory for additional details.
PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits Greg Patton, PropertyInfo Corporation 2) The vendor credits Robert Fly, SalesForce.com
ORIGINAL ADVISORY: Adobe APSB09-02: http://www.adobe.com/support/security/bulletins/apsb09-02.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200902-0563",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "robohelp server",
"scope": "eq",
"trust": 2.7,
"vendor": "adobe",
"version": "7"
},
{
"model": "robohelp server",
"scope": "eq",
"trust": 2.7,
"vendor": "adobe",
"version": "6"
},
{
"model": "robohelp",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "6"
},
{
"model": "robohelp",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "7"
},
{
"model": "device manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"model": "it operations director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "replication manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"model": "tiered storage manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
}
],
"sources": [
{
"db": "BID",
"id": "33887"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001101"
},
{
"db": "NVD",
"id": "CVE-2009-0523"
},
{
"db": "CNNVD",
"id": "CNNVD-200902-604"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:adobe:robohelp:6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:robohelp:7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:robohelp_server:6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:robohelp_server:7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-0523"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Greg Patton",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200902-604"
}
],
"trust": 0.6
},
"cve": "CVE-2009-0523",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2009-0523",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-0523",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200902-604",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-001101"
},
{
"db": "NVD",
"id": "CVE-2009-0523"
},
{
"db": "CNNVD",
"id": "CNNVD-200902-604"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in Adobe RoboHelp Server 6 and 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled when displaying the Help Errors log. \nAn attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. \nAdobe RoboHelp Server 6 and 7 are vulnerable. ----------------------------------------------------------------------\n\nDid you know? Our assessment and impact rating along with detailed\ninformation such as exploit code availability, or if an updated patch\nis released by the vendor, is not part of this mailing-list?\n \nClick here to learn more about our commercial solutions:\nhttp://secunia.com/advisories/business_solutions/\n \nClick here to trial our solutions:\nhttp://secunia.com/advisories/try_vi/\n\n----------------------------------------------------------------------\n\nTITLE:\nAdobe RoboHelp Server Cross-Site Scripting Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA34048\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/34048/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in Adobe RoboHelp Server,\nwhich can be exploited by malicious people to conduct cross-site\nscripting attacks. \n\n1) Certain unspecified input is not properly sanitised before being\nreturned to the user. \n\nSuccessful exploitation requires that the attacker has access to the\nRoboHelp Help Errors log or is able to trick a victim possessing the\nrequired permissions into following a malicious URL. \n\n2) Input passed to unspecified parameters is not properly sanitised\nbefore being returned to the user. \n\nSOLUTION:\nApply patches and regenerate the RoboHelp content. See vendor\u0027s\nadvisory for additional details. \n\nPROVIDED AND/OR DISCOVERED BY:\n1) The vendor credits Greg Patton, PropertyInfo Corporation\n2) The vendor credits Robert Fly, SalesForce.com\n\nORIGINAL ADVISORY:\nAdobe APSB09-02:\nhttp://www.adobe.com/support/security/bulletins/apsb09-02.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-0523"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001101"
},
{
"db": "BID",
"id": "33887"
},
{
"db": "PACKETSTORM",
"id": "75199"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-0523",
"trust": 2.7
},
{
"db": "BID",
"id": "33887",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "34048",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2009-0512",
"trust": 2.4
},
{
"db": "SECTRACK",
"id": "1021755",
"trust": 2.4
},
{
"db": "XF",
"id": "48890",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001101",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200902-604",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "75199",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "33887"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001101"
},
{
"db": "PACKETSTORM",
"id": "75199"
},
{
"db": "NVD",
"id": "CVE-2009-0523"
},
{
"db": "CNNVD",
"id": "CNNVD-200902-604"
}
]
},
"id": "VAR-200902-0563",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.18666667
},
"last_update_date": "2023-12-18T12:46:20.973000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APSB09-02",
"trust": 0.8,
"url": "http://www.adobe.com/support/security/bulletins/apsb09-02.html"
},
{
"title": "APSB09-02",
"trust": 0.8,
"url": "http://www.adobe.com/jp/support/security/bulletins/apsb09-02.html"
},
{
"title": "HS12-011",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs12-011/index.html"
},
{
"title": "HS12-014",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs12-014/index.html"
},
{
"title": "HS12-017",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs12-017/index.html"
},
{
"title": "HS12-014",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs12-014/index.html"
},
{
"title": "HS12-017",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs12-017/index.html"
},
{
"title": "HS12-011",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs12-011/index.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-001101"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-001101"
},
{
"db": "NVD",
"id": "CVE-2009-0523"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://secunia.com/advisories/34048"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/33887"
},
{
"trust": 2.4,
"url": "http://securitytracker.com/id?1021755"
},
{
"trust": 2.4,
"url": "http://www.vupen.com/english/advisories/2009/0512"
},
{
"trust": 2.0,
"url": "http://www.adobe.com/support/security/bulletins/apsb09-02.html"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/48890"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48890"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-0523"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-0523"
},
{
"trust": 0.3,
"url": "http://www.adobe.com/products/robohelpserver/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/business_solutions/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/try_vi/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34048/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "BID",
"id": "33887"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001101"
},
{
"db": "PACKETSTORM",
"id": "75199"
},
{
"db": "NVD",
"id": "CVE-2009-0523"
},
{
"db": "CNNVD",
"id": "CNNVD-200902-604"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "33887"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001101"
},
{
"db": "PACKETSTORM",
"id": "75199"
},
{
"db": "NVD",
"id": "CVE-2009-0523"
},
{
"db": "CNNVD",
"id": "CNNVD-200902-604"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2009-02-24T00:00:00",
"db": "BID",
"id": "33887"
},
{
"date": "2009-03-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-001101"
},
{
"date": "2009-02-25T15:46:37",
"db": "PACKETSTORM",
"id": "75199"
},
{
"date": "2009-02-26T16:17:19.967000",
"db": "NVD",
"id": "CVE-2009-0523"
},
{
"date": "2009-02-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200902-604"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2009-02-24T23:17:00",
"db": "BID",
"id": "33887"
},
{
"date": "2012-06-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-001101"
},
{
"date": "2017-08-08T01:33:58.627000",
"db": "NVD",
"id": "CVE-2009-0523"
},
{
"date": "2009-02-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200902-604"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200902-604"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adobe RoboHelp Server Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-001101"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "xss",
"sources": [
{
"db": "PACKETSTORM",
"id": "75199"
},
{
"db": "CNNVD",
"id": "CNNVD-200902-604"
}
],
"trust": 0.7
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.