CVE-2009-3730
published 2009-10-20CVE-2009-3730: Multiple cross-site scripting (XSS) vulnerabilities in the ReqWeb Help feature (aka the Web Client Help system) in IBM Rational RequisitePro 7.1.0 allow remote…
PriorityP422medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
3.45%
87.5th percentile
Multiple cross-site scripting (XSS) vulnerabilities in the ReqWeb Help feature (aka the Web Client Help system) in IBM Rational RequisitePro 7.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the operation parameter to ReqWebHelp/advanced/workingSet.jsp, or the (2) searchWord, (3) maxHits, (4) scopedSearch, or (5) scope parameter to ReqWebHelp/basic/searchView.jsp.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | rational_requisitepro | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
IBM Rational RequisitePro 7.10 / ReqWebHelp - Multiple Cross-Site Scripting Vulnerabilities
exploitdb·2009-10-15
CVE-2009-3730 IBM Rational RequisitePro 7.10 / ReqWebHelp - Multiple Cross-Site Scripting Vulnerabilities
IBM Rational RequisitePro 7.10 / ReqWebHelp - Multiple Cross-Site Scripting Vulnerabilities
---
Attackers can exploit these issues by enticing an unsuspecting victim into following a malicious URI.
The following example URIs are available:
http://www.example.com/ReqWebHelp/advanced/workingSet.jsp?operation=add*/--> alert(289325) &workingSet=
http://www.example.com/ReqWebHelp/basic/searchView.jsp?searchWord=>''> alert(306531) &maxHits=>''> alert(306531) &scopedSearch=>''> alert(306531) &scope=>''> alert(306531)
Exploit-DB
IBM Rational RequisitePro 7.10 - 'ReqWeb Help Feature ReqWebHelp/advanced/workingSet.jsp?Operation' Cross-Site Scripting
exploitdb·2009-10-15
CVE-2009-3730 IBM Rational RequisitePro 7.10 - 'ReqWeb Help Feature ReqWebHelp/advanced/workingSet.jsp?Operation' Cross-Site Scripting
IBM Rational RequisitePro 7.10 - 'ReqWeb Help Feature ReqWebHelp/advanced/workingSet.jsp?Operation' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/36721/info
IBM Rational RequisitePro is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
These issues affect IBM Rational RequisitePro 7.10; other versions may also be affected.
http://www.example.com/ReqWebHelp/advanced/workingSet.jsp?operation=add*/-->alert(289325)&workingSet=
Exploit-DB
IBM Rational RequisitePro 7.10 - ReqWeb Help Feature 'ReqWebHelp/basic/searchView.jsp' Multiple Cross-Site Scripting Vulnerabilities
exploitdb·2009-10-15
CVE-2009-3730 IBM Rational RequisitePro 7.10 - ReqWeb Help Feature 'ReqWebHelp/basic/searchView.jsp' Multiple Cross-Site Scripting Vulnerabilities
IBM Rational RequisitePro 7.10 - ReqWeb Help Feature 'ReqWebHelp/basic/searchView.jsp' Multiple Cross-Site Scripting Vulnerabilities
---
source: https://www.securityfocus.com/bid/36721/info
IBM Rational RequisitePro is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
These issues affect IBM Rational RequisitePro 7.10; other versions may also be affected.
http://www.example.com/ReqWebHelp/basic/searchView.jsp?searchWord=>''>alert(306531)&maxHits=>''>alert(306531)&scopedSearch=>''>
No writeups or analysis indexed.
http://osvdb.org/59088http://osvdb.org/59089http://secunia.com/advisories/37052http://www-01.ibm.com/support/docview.wss?uid=swg1PK83895http://www.securityfocus.com/bid/36721http://www.vupen.com/english/advisories/2009/2958http://osvdb.org/59088http://osvdb.org/59089http://secunia.com/advisories/37052http://www-01.ibm.com/support/docview.wss?uid=swg1PK83895http://www.securityfocus.com/bid/36721http://www.vupen.com/english/advisories/2009/2958
2009-10-20
Published