Unscored severity · published Oct 13, 2009
CVE-2009-2897
Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from (1) the typeId parameter to mastheadAttach.do, (2) the eid parameter to Resource.do, and (3) the u parameter in a view action to admin/user/UserAdmin.do. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Application Management Suite · Springsource
2.0.0 · source: NVD
HH
Hyperic HQ · Springsource
3.2; 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; +10 more · source: NVD
TS
TC Server · Springsource
6.0.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2897
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2897
Exploit
http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=advisory&name=Hyperic_HQ_Multiple_XSS
forums.hyperic.com
http://forums.hyperic.com/jiveforums/thread.jspa?messageID=22156嚌
Exploit
http://jira.hyperic.com/browse/HHQ-2655
Vendor Advisory
http://secunia.com/advisories/36935
Exploit
http://www.coresecurity.com/content/hyperic-hq-vulnerabilities
www.osvdb.org
http://www.osvdb.org/58608
More from Application Management Suite
–
CVE-2009-2907
Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source…
–
CVE-2009-2898
Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before…