Unscored severity · published Dec 30, 2009
CVE-2009-4473
Multiple cross-site scripting (XSS) vulnerabilities in WorkArea/ContentDesigner/ekformsiframe.aspx in Ektron CMS400.NET 7.6.1.53 and 7.6.6.47, and possibly 7.52 through 7.66sp2,…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in WorkArea/ContentDesigner/ekformsiframe.aspx in Ektron CMS400.NET 7.6.1.53 and 7.6.6.47, and possibly 7.52 through 7.66sp2, allow remote attackers to inject arbitrary web script or HTML via the (1) css, (2) eca, (3) id, and (4) skin parameters. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Cms4000.net · Ektron
7.6.0; 7.6.0; 7.6.0; 7.6.1; 7.6.1; 7.6.1; +16 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-4473
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-4473
Patch
http://dev.ektron.com/forum.aspx?g=posts&t=28048
dev.ektron.com
http://dev.ektron.com/notices.aspx?id=19074
osvdb.org
http://osvdb.org/57667
Vendor Advisory
http://secunia.com/advisories/36591
www.securityfocus.com
http://www.securityfocus.com/bid/36279
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/53043
More from Cms4000.net
–
CVE-2008-5122
SQL injection vulnerability in WorkArea/ContentRatingGraph.aspx in Ektron CMS400.NET 7.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the res…
–
CVE-2008-3499
Unspecified vulnerability in "a page in the workarea folder" in Ektron CMS400.NET 7.00 through 7.04 and 7.50 through 7.52 has unknown impact and attack vectors