CVE-2009-0307

Опубликовано: 22 апр. 2009

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the "Customize Statistics Page" (admin/statistics/ConfigureStatistics) in the MDS Connection Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) before 4.1.6 MR5 allows remote attackers to inject arbitrary web script or HTML via the (1) customDate, (2) interval, (3) lastCustomInterval, (4) lastIntervalLength, (5) nextCustomInterval, (6) nextIntervalLength, (7) action, (8) delIntervalIndex, (9) addStatIndex, (10) delStatIndex, and (11) referenceTime parameters.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rim:blackberry_enterprise_server:*:mr4:*:*:*:*:*:*

Версия до 4.1.6 (включая)

cpe:2.3:a:rim:blackberry_enterprise_server:4.0:*:*:*:*:*:*:*

cpe:2.3:a:rim:blackberry_enterprise_server:4.0:sp3:*:*:*:*:*:*

cpe:2.3:a:rim:blackberry_enterprise_server:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:rim:blackberry_enterprise_server:4.1:*:*:*:*:*:*:*

cpe:2.3:a:rim:blackberry_enterprise_server:4.1:sp3:*:*:*:*:*:*

cpe:2.3:a:rim:blackberry_enterprise_server:4.1.3:*:*:*:*:*:*:*

cpe:2.3:a:rim:blackberry_enterprise_server:4.1.4:*:*:*:*:*:*:*

cpe:2.3:a:rim:blackberry_enterprise_server:4.1.5:*:*:*:*:*:*:*

cpe:2.3:a:rim:blackberry_enterprise_server:4.1.6:*:*:*:*:*:*:*

EPSS

Процентиль: 87%

0.03406

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-6v4f-j7rm-7833

github

почти 4 года назад