4.3

CVE-2009-3731

Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Webworks ≫ Epublisher Version 9.0
Webworks ≫ Epublisher Version 9.1
Webworks ≫ Epublisher Version 9.2
Webworks ≫ Epublisher Version 9.3
Webworks ≫ Epublisher Version 2008.1
Webworks ≫ Epublisher Version 2008.2
Webworks ≫ Epublisher Version 2008.3
Webworks ≫ Epublisher Version 2008.4
Webworks ≫ Epublisher Version 2009.1
Webworks ≫ Epublisher Version 2009.2
Webworks ≫ Help Version 2.0
Webworks ≫ Help Version 3.0
Webworks ≫ Help Version 4.0
Webworks ≫ Help Version 5.0
Webworks ≫ Publisher Version 6.0
Webworks ≫ Publisher Version 7.0
Webworks ≫ Publisher Version 8.0
Webworks ≫ Publisher Version 2003
VMware ≫ Vcenter Version 4.0
   Microsoft ≫ Windows
VMware ≫ Esx Server Version 4.0
VMware ≫ Lab Manager Version 2.0
VMware ≫ Server Version 2.0.2
VMware ≫ Stage Manager Version <= 4.0
VMware ≫ Stage Manager Version 1.0
VMware ≫ Vcenter Lab Manager Version 3.0
VMware ≫ Vcenter Lab Manager Version 3.0.1
VMware ≫ Vcenter Lab Manager Version 3.0.2
VMware ≫ Vcenter Lab Manager Version 4.0
VMware ≫ Vcenter Stage Manager Version 1.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.78% 0.845
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://archives.neohapsis.com/archives/bugtraq/2009-12/0229.html
http://lists.vmware.com/pipermail/security-announce/2009/000073.html
Vendor Advisory
http://secunia.com/advisories/38749
http://secunia.com/advisories/38842
http://securitytracker.com/id?1023683
http://www.osvdb.org/62738
http://www.osvdb.org/62739
http://www.osvdb.org/62740
http://www.osvdb.org/62741
http://www.osvdb.org/62742
http://www.securityfocus.com/archive/1/509883/100/0/threaded
http://www.securityfocus.com/bid/37346
Patch
http://www.webworks.com/Security/2009-0001/
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5944