fkie_cve-2009-1553
Vulnerability from fkie_nvd
Published
2009-05-06 16:30
Modified
2025-04-09 00:30
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.
References
cve@mitre.orghttp://dsecrg.com/pages/vul/show.php?id=134Exploit
cve@mitre.orghttp://jvn.jp/en/jp/JVN73653977/index.html
cve@mitre.orghttp://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html
cve@mitre.orghttp://osvdb.org/54249
cve@mitre.orghttp://osvdb.org/54250
cve@mitre.orghttp://osvdb.org/54251
cve@mitre.orghttp://osvdb.org/54252
cve@mitre.orghttp://osvdb.org/54253
cve@mitre.orghttp://osvdb.org/54254
cve@mitre.orghttp://osvdb.org/54255
cve@mitre.orghttp://osvdb.org/54256
cve@mitre.orghttp://osvdb.org/54257
cve@mitre.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1
cve@mitre.orghttp://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.htmlExploit
cve@mitre.orghttp://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html
cve@mitre.orghttp://www.securityfocus.com/archive/1/503236/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/34824Exploit
cve@mitre.orghttp://www.securityfocus.com/bid/34914
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/1255
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/50453
cve@mitre.orghttps://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29668Patch, Vendor Advisory
cve@mitre.orghttps://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29669Patch, Vendor Advisory
cve@mitre.orghttps://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29675Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://dsecrg.com/pages/vul/show.php?id=134Exploit
af854a3a-2127-422b-91ae-364da2661108http://jvn.jp/en/jp/JVN73653977/index.html
af854a3a-2127-422b-91ae-364da2661108http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/54249
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/54250
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/54251
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/54252
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/54253
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/54254
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/54255
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/54256
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/54257
af854a3a-2127-422b-91ae-364da2661108http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1
af854a3a-2127-422b-91ae-364da2661108http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/503236/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/34824Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/34914
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1255
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/50453
af854a3a-2127-422b-91ae-364da2661108https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29668Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29669Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29675Patch, Vendor Advisory
Impacted products
Vendor Product Version
oracle glassfish_server 2.1



{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:glassfish_server:2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DBDD6781-CF9E-4ED3-861F-99217EE0711C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en Admin Console en Sun GlassFish Enterprise Server  v2.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de una consulta a (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, o (6) webService/webServicesGeneral.jsf; o del par\u00e1metro \"name\" a (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf."
    }
  ],
  "id": "CVE-2009-1553",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2009-05-06T16:30:00.517",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://dsecrg.com/pages/vul/show.php?id=134"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://jvn.jp/en/jp/JVN73653977/index.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54249"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54250"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54251"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54252"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54253"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54254"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54255"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54256"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54257"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/503236/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/34824"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/34914"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2009/1255"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50453"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://dsecrg.com/pages/vul/show.php?id=134"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://jvn.jp/en/jp/JVN73653977/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54249"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54250"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54251"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54252"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54253"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54254"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54255"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54256"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54257"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/503236/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/34824"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/34914"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2009/1255"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50453"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29668"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29669"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs\u0026msgNo=29675"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…