Unscored severity · published Dec 16, 2009
CVE-2009-3731
Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0;…
–
CVSS
2.8%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
vCenter Server · VMware
4.0 · source: NVD
EP
Epublisher · Webworks
9.0; 9.1; 9.2; 9.3; 2008.1; 2008.2; +4 more · source: NVD
ES
Esx Server · Vmware
4.0 · source: NVD
HE
Help · Webworks
2.0; 3.0; 4.0; 5.0 · source: NVD
LM
Lab Manager · Vmware
2.0 · source: NVD
PU
Publisher · Webworks
6.0; 7.0; 8.0; 2003 · source: NVD
SE
Server · Vmware
2.0.2 · source: NVD
SM
Stage Manager · Vmware
through 4.0; 1.0 · source: NVD
VL
Vcenter Lab Manager · Vmware
3.0; 3.0.1; 3.0.2; 4.0 · source: NVD
VS
Vcenter Stage Manager · Vmware
1.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3731
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3731
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2009-12/0229.html
Vendor Advisory
http://lists.vmware.com/pipermail/security-announce/2009/000073.html
secunia.com
http://secunia.com/advisories/38749
secunia.com
http://secunia.com/advisories/38842
securitytracker.com
http://securitytracker.com/id?1023683
www.osvdb.org
http://www.osvdb.org/62738
More from vCenter Server
9.8
CVE-2026-59310
vCenter directory-traversal vulnerability
9.8
CVE-2024-38813
Privilege escalation vulnerability
9.8
CVE-2024-38812
Heap-overflow vulnerability
9.8
CVE-2024-37079
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
9.8
CVE-2023-34048
VMware vCenter Server Out-of-Bounds Write Vulnerability