« Volver al listado

CVE-2009-2405

Estado: ModificadaMedia (4.3)—

Multiple cross-site scripting (XSS) vulnerabilities in the Web Console in the Application Server in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2.0 before 4.2.0.CP08, 4.2.2GA, 4.3 before 4.3.0.CP07, and 5.1.0GA allow remote attackers to inject arbitrary web script or HTML via the (1) monitorName, (2) objectName, (3) attribute, or (4) period parameter to createSnapshot.jsp, or the (5) monitorName, (6) objectName, (7) attribute, (8) threshold, (9) period, or (10) enabled parameter to createThresholdMonitor.jsp. NOTE: some of these details are obtained from third party information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Redhat — Jboss Enterprise Application Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-2405",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-12-15T18:30:00.407",
  "references": [
    {
      "url": "http://secunia.com/advisories/35680",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/37671",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://securitytracker.com/id?1023315",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.osvdb.org/60898",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.osvdb.org/60899",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/37276",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=510023",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54700",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://jira.jboss.org/jira/browse/JBAS-7105",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://jira.jboss.org/jira/browse/JBPAPP-2274",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://jira.jboss.org/jira/browse/JBPAPP-2284",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/35680",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/37671",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1023315",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/60898",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/60899",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/37276",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=510023",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54700",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jira.jboss.org/jira/browse/JBAS-7105",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jira.jboss.org/jira/browse/JBPAPP-2274",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jira.jboss.org/jira/browse/JBPAPP-2284",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Web Console in the Application Server in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2.0 before 4.2.0.CP08, 4.2.2GA, 4.3 before 4.3.0.CP07, and 5.1.0GA allow remote attackers to inject arbitrary web script or HTML via the (1) monitorName, (2) objectName, (3) attribute, or (4) period parameter to createSnapshot.jsp, or the (5) monitorName, (6) objectName, (7) attribute, (8) threshold, (9) period, or (10) enabled parameter to createThresholdMonitor.jsp.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en la consola web en el servidor de aplicaciones en Red Hat JBoss Enterprise Application Platform (también conocido como JBoss EAP or JBEAP) v4.2.0 anteriores a v4.2.0.CP08, v4.2.2GA, v4.3 anteriores a v4.3.0.CP07, y v5.1.0GA  permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de los parámetros (1) monitorName, (2) objectName, (3) attribute, or (4) period parameter to createSnapshot.jsp, or the (5) monitorName, (6) objectName, (7) attribute, (8) threshold, (9) period, or (10) enabled  para createThresholdMonitor.jsp. NOTA: Algunos de los detalles fueron obtenidos de terceras partes."
    }
  ],
  "lastModified": "2026-06-16T23:09:22.483",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E9830D64-C46F-4423-BE0B-0B1FDB765D62"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:cp01:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E715EAF0-DAE9-4FD5-996E-18E61C9CC703"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:cp02:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E6C7D0B-DBC0-4414-9C40-713E01146FA7"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:cp03:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C68C2A35-BC1E-414A-9DB1-7585435DCA33"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp01:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "599FBAC3-2E83-443B-AACB-99BBA896CB19"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp02:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43590B58-A1C7-4105-A00F-6C4F46A6CC5B"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp03:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A44F907E-AE57-4213-B001-A23319B72CF8"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp04:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "243ED156-851C-4897-AF59-86FCA5C9C66F"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp05:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "125BF8B0-AF1B-4FB1-9D41-D9FB30AE23FC"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp06:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3E7C299-8A2D-4733-98AC-F6FA37CC1C6C"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp07:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7398F80B-8318-40E7-A0EE-6CCF7E066C03"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.2:ga:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A04F68DF-F024-4349-B504-1D0588A20B20"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4816097-6982-4FBA-BD34-3D24BCA5A56A"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3:cp01:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "888B9B34-40A3-4CE3-9643-0174CC61751B"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp01:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B3E4026-F98E-4AEB-9FE1-4FFBBF44AC55"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp02:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "960A513A-CAFC-4B3D-ABD7-4659CF545C73"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp03:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2D8DC6D-5E39-4A53-8BB8-F998706D573F"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp04:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AA2D64E-D7E7-400D-AC7E-CB2045750791"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.0:ga:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "881A0E69-23D1-4446-8355-970E50C0290F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}