CVE-2009-0781
En bref
- Source
- NVD
- EPSS
- EPSS 9.72 % · centile 96 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
- http://tomcat.apache.org/security-4.html
- http://marc.info/?l=bugtraq&m=127420533226623&w=2
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:138
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6564
- https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html
- http://www.debian.org/security/2011/dsa-2207
- http://marc.info/?l=bugtraq&m=136485229118404&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49213
- http://secunia.com/advisories/37460
- http://www.vupen.com/english/advisories/2010/3056
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://secunia.com/advisories/35788
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
- http://marc.info/?l=bugtraq&m=133469267822771&w=2
- http://www.vupen.com/english/advisories/2009/1856
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11041
- http://www.securityfocus.com/archive/1/507985/100/0/threaded
- http://secunia.com/advisories/42368
- http://tomcat.apache.org/security-6.html
- http://support.apple.com/kb/HT4077
- https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html
- http://secunia.com/advisories/35685
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19345
- https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html
- http://tomcat.apache.org/security-5.html
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
- http://marc.info/?l=bugtraq&m=129070310906557&w=2
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:136
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1
- http://www.vupen.com/english/advisories/2009/3316
- http://www.securityfocus.com/archive/1/501538/100/0/threaded
- https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-j788-fx57-99wp — Cross-site scripting in Apache Tomcat
Références européennes
- ENISA EUVD · EUVD-2022-4299
- GCVE · GCVE-0-2009-0781
Avis du CERT-FR
- CERTA-2012-AVI-219 — Multiples vulnérabilités dans HP OpenVMS · cert.ssi.gouv.fr
- CERTA-2010-AVI-220 — Multiples vulnérabilités dans HP Performance Manager · cert.ssi.gouv.fr
- CERTA-2010-AVI-143 — Multiples vulnérabilités dans Apple MacOS X · cert.ssi.gouv.fr
- CERTA-2009-AVI-513 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTA-2009-AVI-211 — Multiples vulnérabilités de Apache Tomcat · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.4:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.5:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.6:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.7:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.8:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.9:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.11:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.13:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.14:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.16:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.17:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.18:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.19:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.20:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.21:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.22:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.23:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.25:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.26:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.27:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.30:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.32:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.33:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.34:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.37:*:*:*:*:*:*:*- +45 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |