CVE-2009-4459
published 2009-12-30CVE-2009-4459: Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site…
PriorityP413medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.13%
62.9th percentile
Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as script by Internet Explorer 7 and 8.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | redmine | < redmine 0.9.1-1 (bookworm) | redmine 0.9.1-1 (bookworm) |
| redmine | redmine | <= 0.8.7 | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2009-4459: redmine - Redmine 0.8.7 and earlier uses the title tag before defining the character encod...
vendor_debian·2009·CVSS 4.3
CVE-2009-4459 [MEDIUM] CVE-2009-4459: redmine - Redmine 0.8.7 and earlier uses the title tag before defining the character encod...
Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as script by Internet Explorer 7 and 8.
Scope: local
bookworm: resolved (fixed in 0.9.1-1)
sid: resolved (fixed in 0.9.1-1)
trixie: resolved (fixed in 0.9.1-1)
GHSA
GHSA-vpxw-mhc6-mv6v: Redmine 0
ghsa_unreviewed·2022-05-02
CVE-2009-4459 [MEDIUM] CWE-79 GHSA-vpxw-mhc6-mv6v: Redmine 0
Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as script by Internet Explorer 7 and 8.
OSV
CVE-2009-4459: Redmine 0
osv·2009-12-30·CVSS 4.3
CVE-2009-4459 [MEDIUM] CVE-2009-4459: Redmine 0
Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as script by Internet Explorer 7 and 8.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2009-12-30
Published