CVE-2009-3300

Опубликовано: 06 нояб. 2009

Источник: nvd

CVSS2: 2.6

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.

Ссылки

http://secunia.com/advisories/37237
Vendor Advisory
http://shibboleth.internet2.edu/secadv/secadv_20091104.txt
Vendor Advisory
http://www.debian.org/security/2009/dsa-1947
http://www.vupen.com/english/advisories/2009/3150
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/54140
http://secunia.com/advisories/37237
Vendor Advisory
http://shibboleth.internet2.edu/secadv/secadv_20091104.txt
Vendor Advisory
http://www.debian.org/security/2009/dsa-1947
http://www.vupen.com/english/advisories/2009/3150
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/54140

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:internet2:identity_provider:1.3:*:*:*:*:*:*:*

cpe:2.3:a:internet2:identity_provider:1.3.1:*:*:*:*:*:*:*

cpe:2.3:a:internet2:identity_provider:1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:internet2:identity_provider:1.3.3:*:*:*:*:*:*:*

cpe:2.3:a:internet2:identity_provider:2.1.0:*:*:*:*:*:*:*

cpe:2.3:a:internet2:identity_provider:2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:internet2:identity_provider:2.1.2:*:*:*:*:*:*:*

cpe:2.3:a:internet2:identity_provider:2.1.3:*:*:*:*:*:*:*

cpe:2.3:a:internet2:identity_provider:2.1.4:*:*:*:*:*:*:*

cpe:2.3:a:internet2:service_provider:1.3:*:*:*:*:*:*:*

cpe:2.3:a:internet2:service_provider:1.3.1:*:*:*:*:*:*:*

cpe:2.3:a:internet2:service_provider:1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:internet2:service_provider:1.3.3:*:*:*:*:*:*:*

cpe:2.3:a:internet2:service_provider:2.0:*:*:*:*:*:*:*

cpe:2.3:a:internet2:service_provider:2.1:*:*:*:*:*:*:*

cpe:2.3:a:internet2:service_provider:2.2:*:*:*:*:*:*:*

EPSS

Процентиль: 55%

0.0032

Низкий

2.6 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2009-3300

ubuntu

почти 16 лет назад

CVE-2009-3300

debian

почти 16 лет назад

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Pr ...

GHSA-xjxx-h5w2-fphm

github

больше 3 лет назад

BDU:2015-02030

fstec

больше 10 лет назад

Уязвимости операционной системы Debian GNU/Linux, позволяющие удаленному злоумышленнику нарушить целостность защищаемой информации

BDU:2015-02029

fstec

больше 10 лет назад

EPSS

Процентиль: 55%

0.0032

Низкий

2.6 Low

CVSS2

Дефекты

CWE-79