CVE-2009-3300 — Cross-site Scripting in Identity Provider

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
2.6LOWNVD
EPSS
0.3%
top 44.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Internet2 Shibboleth-spInternet2 Identity ProviderInternet2 Service Provider
Timeline
PublishedNov 6
Latest updateMay 2

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.

CVSS vector

AV:N/AC:H/C:N/I:P/A:NExploitability: 4.9 | Impact: 2.9

Affected Packages3 packages

▶NVDinternet2/service_provider7 versions+6
▶NVDinternet2/identity_provider9 versions+8
▶Debianinternet2/shibboleth-sp< 3.0.2+dfsg1-2+3

🔴Vulnerability Details

3
GHSA
GHSA-xjxx-h5w2-fphm: Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1↗2022-05-02
▶
OSV
CVE-2009-3300: Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1↗2009-11-06
▶
CVEList
CVE-2009-3300: Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1↗2009-11-06
▶

📋Vendor Advisories

1
Debian
CVE-2009-3300: shibboleth-sp - Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (Id...↗2009
▶
CVE-2009-3300 — Cross-site Scripting | cvebase