Unscored severity · published Mar 24, 2010
CVE-2009-2907
Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the description field and unspecified "input fields."
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Application Management Suite · Springsource
through 2.0.0 · source: NVD
HH
Hyperic HQ · Springsource
through 4.0.0; through 4.1.0; through 4.2 · source: NVD
TS
TC Server · Springsource
through 6.0.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2907
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2907
Exploit
http://www.securityfocus.com/bid/38913
Vendor Advisory
http://www.springsource.com/security/cve-2009-2907
More from Application Management Suite
–
CVE-2009-2898
Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before…
–
CVE-2009-2897
Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before…