Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2009-4459

Опубликовано: 30 дек. 2009
Источник: nvd
CVSS2: 4.3
EPSS Низкий

Описание

Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as script by Internet Explorer 7 and 8.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*
Версия до 0.8.7 (включая)
cpe:2.3:a:redmine:redmine:0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.2.1:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.2.2:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.3.0:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.4.2:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.5.0:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.5.1:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.6.0:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.6.1:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.6.2:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.6.3:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.6.4:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.7.0:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.7.0:rc1:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.7.1:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.7.2:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.7.3:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.7.4:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.8.0:rc1:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.8.2:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.8.3:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.8.4:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.8.5:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:0.8.6:*:*:*:*:*:*:*

EPSS

Процентиль: 51%
0.00276
Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

ubuntu логотип

CVE-2009-4459

ubuntu
почти 16 лет назад

Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as script by Internet Explorer 7 and 8.

debian логотип

CVE-2009-4459

debian
почти 16 лет назад

Redmine 0.8.7 and earlier uses the title tag before defining the chara ...

github логотип

GHSA-vpxw-mhc6-mv6v

github
больше 3 лет назад

Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as script by Internet Explorer 7 and 8.

EPSS

Процентиль: 51%
0.00276
Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79