CVE-2009-1553
published 2009-05-06CVE-2009-1553: Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web…
PriorityP426medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
8.20%
94.2th percentile
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | glassfish_server | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-54q2-f3hp-xggh: Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2
ghsa_unreviewed·2022-05-02
CVE-2009-1553 [MEDIUM] CWE-79 GHSA-54q2-f3hp-xggh: Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.
OSV
CVE-2009-1553: Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2
osv·2009-05-06·CVSS 4.3
CVE-2009-1553 [MEDIUM] CVE-2009-1553: Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.
No detection rules found.
Exploit-DB
GlassFish Enterprise Server 2.1 - Admin Console /customMBeans/customMBeans.jsf URI Cross-Site Scripting
exploitdb·2009-05-05
CVE-2009-1553 GlassFish Enterprise Server 2.1 - Admin Console /customMBeans/customMBeans.jsf URI Cross-Site Scripting
GlassFish Enterprise Server 2.1 - Admin Console /customMBeans/customMBeans.jsf URI Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/34824/info
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected.
http://www.example.com/customMBeans/customMBeans.jsf?');};alert("DSecRG_XSS");<!--
Exploit-DB
GlassFish Enterprise Server 2.1 - Admin Console /resourceNode/resources.jsf URI Cross-Site Scripting
exploitdb·2009-05-05
CVE-2009-1553 GlassFish Enterprise Server 2.1 - Admin Console /resourceNode/resources.jsf URI Cross-Site Scripting
GlassFish Enterprise Server 2.1 - Admin Console /resourceNode/resources.jsf URI Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/34824/info
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected.
http://www.example.com/resourceNode/resources.jsf?');};alert("DSecRG_XSS");<!--
Exploit-DB
GlassFish Enterprise Server 2.1 - Admin Console '/resourceNode/jdbcResourceEdit.jsf?name' Cross-Site Scripting
exploitdb·2009-05-05
CVE-2009-1553 GlassFish Enterprise Server 2.1 - Admin Console '/resourceNode/jdbcResourceEdit.jsf?name' Cross-Site Scripting
GlassFish Enterprise Server 2.1 - Admin Console '/resourceNode/jdbcResourceEdit.jsf?name' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/34824/info
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected.
http://www.example.com/resourceNode/jdbcResourceEdit.jsf?name=
Exploit-DB
GlassFish Enterprise Server 2.1 - Admin Console /sysnet/registration.jsf URI Cross-Site Scripting
exploitdb·2009-05-05
CVE-2009-1553 GlassFish Enterprise Server 2.1 - Admin Console /sysnet/registration.jsf URI Cross-Site Scripting
GlassFish Enterprise Server 2.1 - Admin Console /sysnet/registration.jsf URI Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/34824/info
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected.
http://www.example.com/sysnet/registration.jsf?');};alert("DSecRG_XSS");<!--
Exploit-DB
GlassFish Enterprise Server 2.1 - Admin Console '/configuration/auditModuleEdit.jsf?name' Cross-Site Scripting
exploitdb·2009-05-05
CVE-2009-1553 GlassFish Enterprise Server 2.1 - Admin Console '/configuration/auditModuleEdit.jsf?name' Cross-Site Scripting
GlassFish Enterprise Server 2.1 - Admin Console '/configuration/auditModuleEdit.jsf?name' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/34824/info
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected.
http://www.example.com/configuration/auditModuleEdit.jsf?name=
Exploit-DB
GlassFish Enterprise Server 2.1 - Admin Console /webService/webServicesGeneral.jsf URI Cross-Site Scripting
exploitdb·2009-05-05
CVE-2009-1553 GlassFish Enterprise Server 2.1 - Admin Console /webService/webServicesGeneral.jsf URI Cross-Site Scripting
GlassFish Enterprise Server 2.1 - Admin Console /webService/webServicesGeneral.jsf URI Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/34824/info
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected.
http://www.example.com/webService/webServicesGeneral.jsf?');};alert("DSecRG_XSS");<!--
Exploit-DB
GlassFish Enterprise Server 2.1 - Admin Console /applications/applications.jsf URI Cross-Site Scripting
exploitdb·2009-05-05
CVE-2009-1553 GlassFish Enterprise Server 2.1 - Admin Console /applications/applications.jsf URI Cross-Site Scripting
GlassFish Enterprise Server 2.1 - Admin Console /applications/applications.jsf URI Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/34824/info
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected.
http://www.example.com/applications/applications.jsf?');};alert("DSecRG_XSS");<!--
Exploit-DB
GlassFish Enterprise Server 2.1 - Admin Console /configuration/configuration.jsf URI Cross-Site Scripting
exploitdb·2009-05-05
CVE-2009-1553 GlassFish Enterprise Server 2.1 - Admin Console /configuration/configuration.jsf URI Cross-Site Scripting
GlassFish Enterprise Server 2.1 - Admin Console /configuration/configuration.jsf URI Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/34824/info
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected.
http://www.example.com/configuration/configuration.jsf?');};alert("DSecRG_XSS");<!--
http://dsecrg.com/pages/vul/show.php?id=134http://jvn.jp/en/jp/JVN73653977/index.htmlhttp://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.htmlhttp://osvdb.org/54249http://osvdb.org/54250http://osvdb.org/54251http://osvdb.org/54252http://osvdb.org/54253http://osvdb.org/54254http://osvdb.org/54255http://osvdb.org/54256http://osvdb.org/54257http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.htmlhttp://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.htmlhttp://www.securityfocus.com/archive/1/503236/100/0/threadedhttp://www.securityfocus.com/bid/34824http://www.securityfocus.com/bid/34914http://www.vupen.com/english/advisories/2009/1255https://exchange.xforce.ibmcloud.com/vulnerabilities/50453https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29668https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29669https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29675http://dsecrg.com/pages/vul/show.php?id=134http://jvn.jp/en/jp/JVN73653977/index.htmlhttp://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.htmlhttp://osvdb.org/54249http://osvdb.org/54250http://osvdb.org/54251http://osvdb.org/54252http://osvdb.org/54253http://osvdb.org/54254http://osvdb.org/54255http://osvdb.org/54256http://osvdb.org/54257http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.htmlhttp://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.htmlhttp://www.securityfocus.com/archive/1/503236/100/0/threadedhttp://www.securityfocus.com/bid/34824http://www.securityfocus.com/bid/34914http://www.vupen.com/english/advisories/2009/1255https://exchange.xforce.ibmcloud.com/vulnerabilities/50453https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29668https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29669https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29675
2009-05-06
Published