4.3

CVE-2009-3731

Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

Data is provided by the National Vulnerability Database (NVD)
Webworks ≫ Epublisher Version9.0
Webworks ≫ Epublisher Version9.1
Webworks ≫ Epublisher Version9.2
Webworks ≫ Epublisher Version9.3
Webworks ≫ Epublisher Version2008.1
Webworks ≫ Epublisher Version2008.2
Webworks ≫ Epublisher Version2008.3
Webworks ≫ Epublisher Version2008.4
Webworks ≫ Epublisher Version2009.1
Webworks ≫ Epublisher Version2009.2
Webworks ≫ Help Version2.0
Webworks ≫ Help Version3.0
Webworks ≫ Help Version4.0
Webworks ≫ Help Version5.0
Webworks ≫ Publisher Version6.0
Webworks ≫ Publisher Version7.0
Webworks ≫ Publisher Version8.0
Webworks ≫ Publisher Version2003
VMware ≫ Vcenter Version4.0
   Microsoft ≫ Windows
VMware ≫ Esx Server Version4.0
VMware ≫ Lab Manager Version2.0
VMware ≫ Server Version2.0.2
VMware ≫ Stage Manager Version <= 4.0
VMware ≫ Stage Manager Version1.0
VMware ≫ Vcenter Lab Manager Version3.0
VMware ≫ Vcenter Lab Manager Version3.0.1
VMware ≫ Vcenter Lab Manager Version3.0.2
VMware ≫ Vcenter Lab Manager Version4.0
VMware ≫ Vcenter Stage Manager Version1.0.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 2.2% 0.838
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.