« Volver al listado

CVE-2009-4837

Estado: ModificadaMedia (4.3)—

Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) sig[1] parameter to base/base_qry_main.php, or the time[0][1] parameter to (2) base/base_stat_alerts.php or (3) base/base_stat_uaddr.php. NOTE: some of these details are obtained from third party information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Secureideas — Basic Analysis AND Security Engine

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-4837",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-05-06T12:47:23.550",
  "references": [
    {
      "url": "http://base.secureideas.net/news.php",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/35222",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secureideas.cvs.sourceforge.net/viewvc/secureideas/base-php4/base_ag_common.php?sortby=date&view",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://spl0it.org/files/BASE-XSS/Reflective-notes.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://base.secureideas.net/news.php",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/35222",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secureideas.cvs.sourceforge.net/viewvc/secureideas/base-php4/base_ag_common.php?sortby=date&view",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://spl0it.org/files/BASE-XSS/Reflective-notes.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) sig[1] parameter to base/base_qry_main.php, or the time[0][1] parameter to (2) base/base_stat_alerts.php or (3) base/base_stat_uaddr.php.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Basic Analysis y Security Engine (BASE) anterior a v.1.4.3.1 permite a atacantes remotos inyectar códido web o HTML de su elección a través del parámetro sig en (1) base/base_qry_main.php, o el parámetro time en (1) base/base_stat_alerts.php, base/base_stat_uaddr.php. Nota: Algunos de éstos detalles se han obtenido a través de terceros."
    }
  ],
  "lastModified": "2026-06-16T23:14:27.110",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AFAB850-297F-488C-B0CC-823F3815E9D0",
              "versionEndIncluding": "1.4.3"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1B2A52D-E8D4-4BA4-8E72-AC5192DE0D4C"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3385377-F113-43BF-B7EA-11D2E3128CE4"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB7528DA-7B3C-4AD6-9F00-3F4288C7ACC2"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B7097AFD-1F68-4275-BB1A-FFADA8A419F9"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0826792-D304-40F1-A9E8-F120B70CF677"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B3F401F-C1D8-44C1-AF7D-56F4E003D080"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "906EE821-2A84-4166-9F25-4D1FBC8CAF20"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D97C7A9E-D341-4D51-9550-F86604D5B802"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50493815-A159-4AD4-9570-16A0873EE0E2"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4CDA655-E362-4F1C-9449-A6A137EF3156"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.2.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B5BB059-63B9-43C7-88BA-CB8855180B5F"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.2.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "411F66D7-8D61-4756-9F41-9E2EF5C29F59"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E411919-C5CA-48CA-91ED-F21FC505D4C8"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.3.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1871740-5E57-4E16-AFDF-8B3456A38FE8"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.3.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A314420F-CCF2-4134-89CF-9EA8A418A9FC"
            },
            {
              "criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.3.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7C3D1A1-632C-410A-AE06-0679D4A57C7F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}