4.3
CVE-2009-4185
- EPSS 0.64%
- Published 05.02.2010 22:30:02
- Last modified 11.04.2025 00:51:21
- Source hp-security-alert@hp.com
- Teams watchlist Login
- Open Login
Cross-site scripting (XSS) vulnerability in proxy/smhui/getuiinfo in HP System Management Homepage (SMH) before 6.0 allows remote attackers to inject arbitrary web script or HTML via the servercert parameter.
Data is provided by the National Vulnerability Database (NVD)
Hp ≫ System Management Homepage Version <= 3.0.2.77
Hp ≫ System Management Homepage Version2.0.0
Hp ≫ System Management Homepage Version2.0.1
Hp ≫ System Management Homepage Version2.0.2
Hp ≫ System Management Homepage Version2.1
Hp ≫ System Management Homepage Version2.1.0-103
Hp ≫ System Management Homepage Version2.1.0-109
Hp ≫ System Management Homepage Version2.1.0-118
Hp ≫ System Management Homepage Version2.1.1
Hp ≫ System Management Homepage Version2.1.2
Hp ≫ System Management Homepage Version2.1.2-127
Hp ≫ System Management Homepage Version2.1.3
Hp ≫ System Management Homepage Version2.1.3.132
Hp ≫ System Management Homepage Version2.1.4
Hp ≫ System Management Homepage Version2.1.4-143
Hp ≫ System Management Homepage Version2.1.5
Hp ≫ System Management Homepage Version2.1.5-146
Hp ≫ System Management Homepage Version2.1.6
Hp ≫ System Management Homepage Version2.1.6-156
Hp ≫ System Management Homepage Version2.1.7
Hp ≫ System Management Homepage Version2.1.7-168
Hp ≫ System Management Homepage Version2.1.8
Hp ≫ System Management Homepage Version2.1.8-177
Hp ≫ System Management Homepage Version2.1.9
Hp ≫ System Management Homepage Version2.1.9-178
Hp ≫ System Management Homepage Version2.1.10
Hp ≫ System Management Homepage Version2.1.10-186
Hp ≫ System Management Homepage Version2.1.11
Hp ≫ System Management Homepage Version2.1.11-197
Hp ≫ System Management Homepage Version2.1.12-118
Hp ≫ System Management Homepage Version2.1.12-200
Hp ≫ System Management Homepage Version2.1.15-210
Hp ≫ System Management Homepage Version2.2.6
Hp ≫ System Management Homepage Version2.2.8
Hp ≫ System Management Homepage Version3.0.0-68
Hp ≫ System Management Homepage Version3.0.1.73
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.64% | 0.697 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.